Security News > 2021 > December > Mozilla patches critical “BigSig” cryptographic bug: Here’s how to track it down and fix it

Many software vendors rely on third-party open source cryptographic tools, such as OpenSSL, or simply hook up with the cryptographic libraries built into the operating system itself, such as Microsoft's Secure Channel on Windows or Apple's Secure Transport on macOS and iOS. But Mozilla has always used its own cryptographic library, known as NSS, short for Network Security Services, instead of relying on third-party or system-level code.

The vulnerability is officially known as CVE-2021-43527, but Ormandy has jokingly dubbed it BigSig, because it involves a buffer overflow provoked by submitting a digital signature signed with a cryptographic key that is bigger than the largest key NSS is programmed to expect.

The space reserved for the public key is chosen by working out the size of the largest possible DSA key supported by NSS, the largest possible Elliptic Curve key supported by NSS, and the largest RSA key, and then using the largest of those values to ensure a buffer that is "Always big enough".

RSA keys are notoriously much larger that those of other cryptographic algorithms, typically reaching 2048 or even 4096 bits, instead of the 256 or 512 bits typically required for EC keys.

For advice on how to locate any NSS library files on your computer, and how to check what version you have, see below.

Just because most people won't generate huge cryptographic keys doesn't mean that no one will, whether they do so by accident or by design.

News URL

https://nakedsecurity.sophos.com/2021/12/03/mozilla-patches-exploitable-bigsig-cryptographic-bug/