Vulnerabilities > CVE-2014-1569 - Unspecified vulnerability in Mozilla Network Security Services
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN mozilla
nessus
Summary
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
Vulnerable Configurations
Nessus
NASL family Windows NASL id MOZILLA_THUNDERBIRD_31_3.NASL description The version of Thunderbird installed on the remote Windows host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in last seen 2020-06-01 modified 2020-06-02 plugin id 79666 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79666 title Mozilla Thunderbird < 31.3 Multiple Vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2014-16530.NASL description Update the nss, nss-softokn, and nss-util packages to nss-3.17.3 For more details on the bugs fixed with this release, please see the upstream release notes at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17 .3_release_notes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-01-08 plugin id 80402 published 2015-01-08 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80402 title Fedora 20 : nss-3.17.3-2.fc20 / nss-softokn-3.17.3-1.fc20 / nss-util-3.17.3-1.fc20 (2014-16530) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-0171-1.NASL description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 83676 published 2015-05-20 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83676 title SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:0171-1) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2014-252.NASL description Updated nss packages fix security vulnerabilities : In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data (CVE-2014-1569). This update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE. last seen 2020-06-01 modified 2020-06-02 plugin id 80041 published 2014-12-16 reporter This script is Copyright (C) 2014-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80041 title Mandriva Linux Security Advisory : nss (MDVSA-2014:252) NASL family Windows NASL id MOZILLA_FIREFOX_31_3_ESR.NASL description The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in last seen 2020-06-01 modified 2020-06-02 plugin id 79664 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79664 title Firefox ESR 31.x < 31.3 Multiple Vulnerabilities NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_7AE618709DD24884A2F2F19BB5784D09.NASL description The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer MFSA-2014-88 Buffer overflow while parsing media content MFSA-2014-87 Use-after-free during HTML5 parsing MFSA-2014-86 CSP leaks redirect data via violation reports MFSA-2014-85 XMLHttpRequest crashes with some input streams MFSA-2014-84 XBL bindings accessible via improper CSS declarations MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3) last seen 2020-06-01 modified 2020-06-02 plugin id 79707 published 2014-12-04 reporter This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79707 title FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09) NASL family SuSE Local Security Checks NASL id SUSE_11_FIREFOX-201501-150126.NASL description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ last seen 2020-06-01 modified 2020-06-02 plugin id 81122 published 2015-02-02 reporter This script is Copyright (C) 2015-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81122 title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225) NASL family Web Servers NASL id GLASSFISH_CPU_JUL_2015.NASL description The version of Oracle GlassFish Server running on the remote host is affected by multiple vulnerabilities : - A security bypass vulnerability exists in the bundled Network Security Services (NSS) library because the definite_length_decoder() function, in file quickder.c, does not properly form the DER encoding of an ASN.1 length. A remote attacker, by using a long byte sequence for an encoding, can exploit this issue to conduct undetected smuggling of arbitrary data. (CVE-2014-1569) - An unspecified flaw exists related to the Java Server Faces subcomponent. A remote attacker can exploit this to affect the integrity of the system. (CVE-2015-2623) - An unspecified flaw exists related to the Java Server Faces and Web Container subcomponents. A remote attacker can exploit this to affect the integrity of the system. (CVE-2015-4744) last seen 2020-06-01 modified 2020-06-02 plugin id 84810 published 2015-07-16 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84810 title Oracle GlassFish Server Multiple Vulnerabilities (July 2015 CPU) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-185.NASL description MozillaFirefox, mozilla-nss were updated to fix 18 security issues. MozillaFirefox was updated to version 36.0. These security issues were fixed : - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory safety hazards - CVE-2015-0832: Appended period to hostnames can bypass HPKP and HSTS protections - CVE-2015-0830: Malicious WebGL content crash when writing strings - CVE-2015-0834: TLS TURN and STUN connections silently fail to simple TCP connections - CVE-2015-0831: Use-after-free in IndexedDB - CVE-2015-0829: Buffer overflow in libstagefright during MP4 video playback - CVE-2015-0828: Double-free when using non-default memory allocators with a zero-length XHR - CVE-2015-0827: Out-of-bounds read and write while rendering SVG content - CVE-2015-0826: Buffer overflow during CSS restyling - CVE-2015-0825: Buffer underflow during MP3 playback - CVE-2015-0824: Crash using DrawTarget in Cairo graphics library - CVE-2015-0823: Use-after-free in Developer Console date with OpenType Sanitiser - CVE-2015-0822: Reading of local files through manipulation of form autocomplete - CVE-2015-0821: Local files or privileged URLs in pages can be opened into new tabs - CVE-2015-0819: UI Tour whitelisted sites in background tab can spoof foreground tabs - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass mozilla-nss was updated to version 3.17.4 to fix the following issues : - CVE-2014-1569: QuickDER decoder length issue (bnc#910647). - bmo#1084986: If an SSL/TLS connection fails, because client and server don last seen 2020-06-05 modified 2015-03-02 plugin id 81589 published 2015-03-02 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81589 title openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-154.NASL description nss 3.12.8-1+squeeze11 fixes two security issues : CVE-2011-3389 SSL 3.0 and TLS 1.0 connections were vulnerable to some chosen plaintext attacks which allowed man-in-the middle attackers to obtain plaintext HTTP headers on an HTTPS session. This issue is known as the last seen 2020-03-17 modified 2015-03-26 plugin id 82137 published 2015-03-26 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82137 title Debian DLA-154-1 : nss security update (BEAST) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3186.NASL description It was discovered that the Mozilla Network Security Service library (nss) incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack. last seen 2020-03-17 modified 2015-03-17 plugin id 81830 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81830 title Debian DSA-3186-1 : nss - security update NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_34.NASL description The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists due to the last seen 2020-06-01 modified 2020-06-02 plugin id 79662 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79662 title Firefox < 34.0 Multiple Vulnerabilities (Mac OS X) NASL family MacOS X Local Security Checks NASL id MACOSX_THUNDERBIRD_31_3.NASL description The version of Thunderbird installed on the remote Mac OS X host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in last seen 2020-06-01 modified 2020-06-02 plugin id 79663 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79663 title Mozilla Thunderbird < 31.3 Multiple Vulnerabilities (Mac OS X) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-0173-1.NASL description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificates list. For more information, please refer to https://www.mozilla.org/en-US/security/advisories/ . Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 83677 published 2015-05-20 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83677 title SUSE SLES11 Security Update : Mozilla Firefox (SUSE-SU-2015:0173-1) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2452-1.NASL description It was discovered that NSS incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 80410 published 2015-01-08 reporter Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/80410 title Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS / 14.10 : nss vulnerability (USN-2452-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-0076-1.NASL description This update fixes the following security issues in MozillaFirefox : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889, bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538, bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871, bmo#1098583) Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC Also Mozilla NSS was updated to 3.17.3 to fix : - The QuickDER decoder now decodes lengths robustly (bmo#1064670/CVE-2014-1569) - Support for TLS_FALLBACK_SCSV has been added to the ssltap and tstclnt utilities - Changes in CA certificates Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 83666 published 2015-05-20 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83666 title SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-059.NASL description Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages : The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name last seen 2020-06-01 modified 2020-06-02 plugin id 81942 published 2015-03-19 reporter This script is Copyright (C) 2015-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81942 title Mandriva Linux Security Advisory : nss (MDVSA-2015:059) NASL family Web Servers NASL id SUN_JAVA_WEB_SERVER_7_0_22.NASL description According to its self-reported version, the Oracle iPlanet Web Server (formerly known as Sun Java System Web Server) running on the remote host is 6.1.x prior to 6.1.21 or 7.0.x prior to 7.0.22. It is, therefore, affected by a flaw in the definite_length_decoder() function in the Network Security Services (NSS) library due to a failure to ensure that the DER encoding of an ASN.1 length is properly formed when handling PKCS#1 signatures. A remote attacker, by using a long byte sequence for an encoding, can exploit this to conduct a data-smuggling attack or inject arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 84963 published 2015-07-23 reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/84963 title Oracle iPlanet Web Server 6.1.x < 6.1.21 / 7.0.x < 7.0.22 NSS Signature Handling Remote Code Injection NASL family SuSE Local Security Checks NASL id SUSE_11_FIREFOX-201501-150127.NASL description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ last seen 2020-06-01 modified 2020-06-02 plugin id 81123 published 2015-02-02 reporter This script is Copyright (C) 2015-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81123 title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225) NASL family Windows NASL id MOZILLA_FIREFOX_34.NASL description The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists due to the last seen 2020-06-01 modified 2020-06-02 plugin id 79665 published 2014-12-02 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79665 title Firefox < 34.0 Multiple Vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2014-17085.NASL description Updated nss package fixes a conflict among the nss-tools pp man page an the similarly named one from perl-PAR_Packager. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2014-12-26 plugin id 80236 published 2014-12-26 reporter This script is Copyright (C) 2014-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80236 title Fedora 21 : nss-3.17.3-2.fc21 (2014-17085) NASL family Windows NASL id IPLANET_WEB_PROXY_4_0_26.NASL description According to its self-reported version, the Oracle iPlanet Web Proxy Server (formerly known as Sun Java System Web Proxy Server) installed on the remote host is version 4.0.x prior to 4.0.26. It is, therefore, affected by a flaw in the definite_length_decoder() function in the Network Security Services (NSS) library due to a failure to ensure that the DER encoding of an ASN.1 length is properly formed when handling PKCS#1 signatures. A remote attacker, by using a long byte sequence for an encoding, can exploit this to conduct a data-smuggling attack or inject arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 84962 published 2015-07-23 reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/84962 title Oracle iPlanet Web Proxy Server 4.0.x < 4.0.26 NSS Signature Handling Remote Code Injection
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
References
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes
- https://www.imperialviolet.org/2014/09/26/pkcs1.html
- http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf
- https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064670
- http://www.debian.org/security/2015/dsa-3186
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securitytracker.com/id/1032909