OSVDB ID: 32106

Title: Mozilla Network Security Services SSLv2 Server Remote Overflow

Info

Disclosure
Feb 23, 2007

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 A remote overflow exists in Mozilla Foundation's Network Security Services (NSS) libraries. The vulnerability is due to inadequate error checking in the Network Security Services (NSS) code that is responsible for handling the Client Master Key. A remote attacker can exploit the vulnerability with a specially-crafted SSLv2 certificate containing a Client Master Key with invalid length values. This may result in a stack-based buffer overflow allowing the attacker to crash the affected server or to execute arbitrary code in the context of the affected server, resulting in a loss of availability and/or integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Exploit: Exploit Public, Exploit Private
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to the following versions of the affected products as these versions have been reported to fix this vulnerability: Mozilla Network Security Services (NSS): version 3.11.5 or higher It is also possible to correct the flaw by implementing the following workaround(s): Disable the SSLv2 protocol in any product that has not already done so.

Products

Mozilla Organization

Network Security Services (NSS)

 3.11.5
3.11.4
3.11.3
3.10
3.9.x
3.8.x
3.7.x
3.6.x
3.5.x
3.4.x
3.3.x
3.2.x
3.11.5
3.11.4
3.11.3
3.10
3.9.x
3.8.x
3.7.x
3.6.x
3.5.x
3.4.x
3.3.x
3.2.x

References

Credit
  • Michał Luczaj - regenrechto2.pl -
  • Michał Luczaj - regenrechto2.pl -


Direct URL: http://osvdb.org/32106