OSVDB ID: 9116

Title: Netscape Network Security Services (NSS) Library SSLv2 Challenge Overflow

Info

Disclosure
Aug 23, 2004

Discovery
Unknown

Dates

Exploit
Aug 25, 2004

Solution
Unknown

Description

 A remote overflow exists in the Network Security Services library. The library fails to validate the length of the "challenge" field during negotiation of the SSLv2 protocol. This library is used by many commercial and open-source products to provide SSL services. Affected applications include the Netscape Enterprise web server, the SunONE web, directory, and mail servers, and a large number of open-source application servers. Successful exploitation of this issue may result in arbitrary code execution with the privileges of the vulnerable service, leading to a lack of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Commercial
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 The solution to this vulnerability depends on the affected application. In most situations, you can simply replace the NSS library with the latest version from the Mozilla Organization. Version 3.9.2 and newer of the NSS library are not vulnerable to this flaw. In the case of commercial applications, the vendor should be able to provide you with a patched version of the product. It is also possible to correct the flaw by implementing the following workaround(s): Disable the SSLv2 protocol and all SSLv2 ciphers. The process for accomplishing this task depends on the specific application.

Products

Mozilla Organization

Network Security Services

 3.2
3.2.1
3.3
3.3.1
3.3.2
3.4
3.4.1
3.4.2
3.5
3.6
3.6.1
3.7.1
3.7.2
3.7.3
3.7.5
3.7.7
3.8
3.9
3.9.2
3.2
3.2.1
3.3
3.3.1
3.3.2
3.4
3.4.1
3.4.2
3.5
3.6
3.6.1
3.7.1
3.7.2
3.7.3
3.7.5
3.7.7
3.8
3.9
3.9.2

Sun Microsystems, Inc.

Java Enterprise System

 2004Q2
2003Q4
2004Q2
2003Q4

References

Credit
  • Mark Dowd - Avertavertlabs.com - McAfee Avert(tm) Labs
  • Mark Dowd - Avertavertlabs.com - McAfee Avert(tm) Labs


Direct URL: http://osvdb.org/9116