RHSA-2009:1184: nspr and nss security and bug fix update
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
9 | (AV:N/AC:M/Au:N/C:C/I:C/A:C) | August 03, 2009 | September 12, 2009 | July 04, 2017 |
Description
Netscape Portable Runtime (NSPR) provides platform independence for non-GUIoperating system facilities. These facilities include threads, threadsynchronization, normal file and network I/O, interval timing, calendartime, basic memory management (malloc and free), and shared library linking.Network Security Services (NSS) is a set of libraries designed to supportthe cross-platform development of security-enabled client and serverapplications. Applications built with NSS can support SSLv2, SSLv3, TLS,and other security standards.These updated packages upgrade NSS from the previous version, 3.12.2, to aprerelease of version 3.12.4. The version of NSPR has also been upgradedfrom 4.7.3 to 4.7.4. Moxie Marlinspike reported a heap overflow flaw in a regular expressionparser in the NSS library used by browsers such as Mozilla Firefox to matchcommon names in certificates. A malicious website could present acarefully-crafted certificate in such a way as to trigger the heapoverflow, leading to a crash or, possibly, arbitrary code execution withthe permissions of the user running the browser. (CVE-2009-2404)Note: in order to exploit this issue without further user interaction inFirefox, the carefully-crafted certificate would need to be signed by aCertificate Authority trusted by Firefox, otherwise Firefox presents thevictim with a warning that the certificate is untrusted. Only if the userthen accepts the certificate will the overflow take place.Dan Kaminsky discovered flaws in the way browsers such as Firefox handleNULL characters in a certificate. If an attacker is able to get acarefully-crafted certificate signed by a Certificate Authority trusted byFirefox, the attacker could use the certificate during a man-in-the-middleattack and potentially confuse Firefox into accepting it by mistake.(CVE-2009-2408)Dan Kaminsky found that browsers still accept certificates with MD2 hashsignatures, even though MD2 is no longer considered a cryptographicallystrong algorithm. This could make it easier for an attacker to create amalicious certificate that would be treated as trusted by a browser. NSSnow disables the use of MD2 and MD4 algorithms inside signatures bydefault. (CVE-2009-2409)These version upgrades also provide a fix for the following bug:On the server side, the nss_error_log under /var/log/httpd/ contained thefollowing message:[error] Re-negotiation handshake failed: Not accepted by client!?Also, /var/log/httpd/error_log contained this error:SSL Library Error: -8071 The OCSP server experienced an internal errorWith these updated packages, the dependency problem which caused thisfailure has been resolved so that SSL client authentication with anApache web server using mod_nss which is configured for NSSOCSP succeedsas expected. Note that if the presented client certificate is expired,then access is denied, the user agent is presented with an error messageabout the invalid certificate, and the OCSP queries are seen in the OCSPresponder. Also, similar OCSP status verification happens for SSL servercertificates used in Apache upon instance start or restart. (BZ#508027)All users of nspr and nss are advised to upgrade to these updated packages,which resolve these issues.
Scan For This Vulnerability
Use our top-rated tool to discover, prioritize, and remediate your vulnerabilities
References
- APPLE-APPLE-SA-2009-11-09-1
- BID-35891
- CERT-TA10-103B
- CVE-2009-2404
- CVE-2009-2408
- CVE-2009-2409
- DEBIAN-DSA-1874
- DEBIAN-DSA-1888
- OSVDB-56723
- OVAL-OVAL10751
- OVAL-OVAL10763
- OVAL-OVAL11174
- OVAL-OVAL6631
- OVAL-OVAL7155
- OVAL-OVAL8458
- OVAL-OVAL8594
- OVAL-OVAL8658
- REDHAT-RHSA-2009:1184
- REDHAT-RHSA-2009:1185
- REDHAT-RHSA-2009:1207
- REDHAT-RHSA-2009:1432
- REDHAT-RHSA-2010:0095
- SUSE-SUSE-SA:2009:048
Solution
redhat-upgrade-nsprRelated Vulnerabilities
- RHSA-2009:1185: seamonkey security update
- MFSA2009-43 Firefox: Heap overflow in certificate regexp parsing (CVE-2009-2404)
- MFSA2009-42 Firefox: Compromise of SSL-protected communication (CVE-2009-2408)
- USN-830-1: OpenSSL vulnerability
- SUSE Linux Security Advisory: SUSE-SR:2009:018
- ELSA-2010-0163 Moderate: Enterprise Linux openssl security update
- USN-809-1: GnuTLS vulnerabilities
- USN-810-1: NSS vulnerabilities
- RHSA-2009:1584: java-1.6.0-openjdk security update
- Sun Patch: NSS_NSPR_JSS 3.35 Solaris: NSPR 4.18 / NSS 3.35 / JSS 4.3.2 Mainte
- FreeBSD: mozilla -- multiple vulnerabilities (Multiple CVEs)
- MFSA2009-43 Thunderbird: Heap overflow in certificate regexp parsing (CVE-2009-2404)
- Sun Patch: Mozilla 1.7_x86: Mozilla Thunderbird email client
- VMSA-2010-0001.1: Update for Service Console packages nss and nspr (CVE-2009-2408)
- Mozilla Firefox Multiple Vulnerabilities Fixed in 3.0.13 and 3.5.0
- VMSA-2010-0001.1: Update for Service Console packages nss and nspr (CVE-2009-2404)
- ELSA-2010-0054 Moderate: Enterprise Linux openssl security update
- ELSA-2010-0166 Moderate: Enterprise Linux gnutls security update
- Sun Patch: NSS_NSPR_JSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
- RHSA-2009:1571: java-1.5.0-sun security update
- RHSA-2010:0163: openssl security update
- RHSA-2009:1207: nspr and nss security update
- SUSE Linux Security Vulnerability: CVE-2009-2408
- RHSA-2010:0166: gnutls security update
- Gentoo Linux: CVE-2009-2404: Mozilla Products: Multiple vulnerabilities
- Sun Patch: NSS_NSPR_JSS 3.30.2_x86: NSPR 4.15 / NSS 3.30.2 / JSS 4.3.2
- Oracle Solaris 11: CVE-2009-2408 (11.1 SRU 19.6.0)
- Gentoo Linux: CVE-2009-2408: Mozilla Products: Multiple vulnerabilities
- Sun Patch: NSS_NSPR_JSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
- MFSA2009-42 Thunderbird: Compromise of SSL-protected communication (CVE-2009-2408)
- RHSA-2009:1560: java-1.6.0-sun security update
- Sun Patch: SunOS 5.10_x86: openssl patch
- VMSA-2010-0015.1: Service Console update (CVE-2009-2409)
- MFSA2009-42 SeaMonkey: Compromise of SSL-protected communication (CVE-2009-2408)
- RHSA-2009:1190: nspr and nss security and bug fix update
- RHSA-2010:0054: openssl security update
- SUSE Linux Security Advisory: SUSE-SA:2009:048
- Sun Patch: NSS_NSPR_JSS 3.35_x86: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
- USN-859-1: OpenJDK vulnerabilities
- SUSE Linux Security Vulnerability: CVE-2009-2404
- Sun Patch: NSS_NSPR_JSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
- RHSA-2009:1662: Red Hat Network Satellite Server Sun Java Runtime security update
- SUSE Linux Security Advisory: SUSE-SR:2009:016
- Sun Patch: NSS_NSPR_JSS 3.35 Solaris_x86: NSPR 4.18 / NSS 3.35 / JSS 4.3.2 Ma
- MFSA2009-43 SeaMonkey: Heap overflow in certificate regexp parsing (CVE-2009-2404)
- OS X update for libsecurity (CVE-2009-2409)
- VMSA-2010-0019: Service Console update (CVE-2009-2409)
- Sun Patch: Mozilla 1.7: Mozilla Thunderbird email client
- OS X update for OpenLDAP (CVE-2009-2408)
- RHSA-2009:1432: seamonkey security update
- Gentoo Linux: CVE-2009-2409: Sun JDK/JRE: Multiple vulnerabilities
- SUSE Linux Security Vulnerability: CVE-2009-2409
- IBM AIX: sendmail_advisory (CVE-2009-2408): AIX sendmail SSL certificate vulnerability
- VMSA-2010-0009.1: Service Console package openssl (CVE-2009-2409)
- RHSA-2009:1186: nspr and nss security, bug fix, and enhancement update
- VMSA-2010-0001.1: Update for Service Console packages nss and nspr (CVE-2009-2409)
- Sun Patch: SunOS 5.9: wanboot and pkg utilities Patch