Rapid7 Vulnerability & Exploit Database

USN-2452-1: NSS vulnerability

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

USN-2452-1: NSS vulnerability

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

12/15/2014

Created

07/25/2018

Added

01/09/2015

Modified

07/09/2020

Description

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.

Solution(s)

ubuntu-upgrade-libnss3
ubuntu-upgrade-libnss3-1d

References

https://attackerkb.com/topics/cve-2014-1569
CVE - 2014-1569
DSA-3186
Category I
V0061081
2015-A-0154
USN-2452-1

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;