A remote overflow exists in multiple versions of Mozilla Firefox, Mozilla Network Security Services (NSS), Mozilla SeaMonkey, and Mozilla Thunderbird. The vulnerability is due to an error in the Network Security Services (NSS) code that can occur when processing certain SSLv2 server messages. The products fail to properly process SSL server certificates which possess an RSA public key that is too small to encrypt the entire SSLv2 "Master Secret". This may result in a heap-based overflow and may allow an attacker execution of arbitrary code, resulting in a loss of integrity and/or availability.

Support for SSLv2 is disabled in Firefox 2 due to other known weaknesses in the protocol; Firefox 2 is not vulnerable unless the user has modified hidden internal NSS settings to re-enable SSLv2 support.

Below is the NSS CVS change that fixes the vulnerability:
===================================================================
Index: sslcon.c
===================================================================
RCS file: /cvsroot/mozilla/security/nss/lib/ssl/sslcon.c,v
retrieving revision 1.34
diff -p -u -9 -r1.34 sslcon.c
--- sslcon.c 14 Nov 2006 01:09:54 -0000 1.34
+++ sslcon.c 19 Dec 2006 08:08:39 -0000
@@ -1975,19 +1975,22 @@ ssl2_ClientHandleServerCert(sslSocket *s
unsigned char *
ssl_FormatSSL2Block(unsigned modulusLen, SECItem *data)
{
unsigned char *block;
unsigned char *bp;
int padLen;
SECStatus rv;
int i;
- PORT_Assert (data->len <= (modulusLen - (3 + RSA_BLOCK_MIN_PAD_LEN)));
+ if (modulusLen < data->len + (3 + RSA_BLOCK_MIN_PAD_LEN)) {
+ PORT_SetError(SEC_ERROR_BAD_KEY);
+ return NULL;
+ }
block = (unsigned char *) PORT_Alloc(modulusLen);
if (block == NULL)
return NULL;
bp = block;

Upgrade to the following versions of the affected products as these versions have been reported to fix this vulnerability:
Mozilla Network Security Services (NSS): version 3.11.5 or higher
Mozilla Firefox: version 2.0.2 or higher
Mozilla Thunderbird: version 1.5.0.10 or higher
Mozilla SeaMonkey: version 1.0.8 or higher

It is also possible to correct the flaw by implementing the following workaround(s): Disable the SSLv2 protocol in any product that has not already done so.
In Mozilla Firefox 1.5:
1) Click on the Advanced icon in the Options/Preferences dialog.
2) On the Security tab uncheck the box next to "Use SSL 2.0"
3) Click the "OK" button.

In Mozilla Thunderbird 1.5:
1) Click on the Advanced icon in the Options/Preferences dialog.
2) Click the "Config Editor..." button.
3) Type ssl2 in the Filter field
4) Double-click security.enable_ssl2 to change the value to false and close the window.

Mozilla Network Security Services (NSS):
Disable the SSLv2 protocol.

• Security Tracker: 1017696 1017720 1017776
• CVE ID: 2007-0008 (see also: NVD)
• Bugtraq ID: 22694
• Secunia Advisory ID: 24205 24253 24333 24342 24343 24384 24389 24395 24406 24410 24455 24456 24457 24522 24562 24569 24650 24703 25588 25597
• Related OSVDB ID: 32106
• ISS X-Force ID: 32666
• CERT VU: 377812
• VUPEN Advisory: ADV-2007-0718 ADV-2007-0719
• Other Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc http://fedoranews.org/cms/node/2709
  http://fedoranews.org/cms/node/2721
  http://fedoranews.org/cms/node/2728
  http://fedoranews.org/cms/node/2747
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482
  http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
  http://lists.suse.com/archive/suse-security-announce/2007-Mar/0006.html
  http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
  http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947
  http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
  http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1
  http://www.gentoo.org/security/en/glsa/glsa-200703-18.xml
  http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml
  http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
  http://www.mandriva.com/security/advisories?name=MDKSA-2007:052
  http://www.ubuntu.com/usn/usn-428-1
  http://www.ubuntu.com/usn/usn-428-2
  http://www.ubuntu.com/usn/usn-431-1
  http://www.us.debian.org/security/2007/dsa-1336
• Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc http://fedoranews.org/cms/node/2713
  http://lists.rpath.com/pipermail/security-announce/2007-February/000153.html
  http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1
  http://www.mozilla.org/security/announce/2007/mfsa2007-06.html
• Generic Informational URL: http://www.mozilla.org/projects/security/known-vulnerabilities.html
• Vendor Specific News/Changelog Entry: https://bugzilla.mozilla.org/show_bug.cgi?id=364319
• CIAC Advisory: R-164
• RedHat RHSA: RHSA-2007:0077 RHSA-2007:0078 RHSA-2007:0078-2 RHSA-2007:0079 RHSA-2007:0097-5 RHSA-2007:0108-4

• regenrecht - iDefense Labs VCP