Executive Summary

Summary
Title NSS vulnerability
Informations
Name USN-2088-1 First vendor Publication 2014-01-23
Vendor Ubuntu Last vendor Modification 2014-01-23
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Cvss Base Score 5.8 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS

Summary:

NSS could be made to expose sensitive information over the network.

Software Description: - nss: Network Security Service library

Details:

Brian Smith discovered that NSS incorrectly handled the TLS False Start feature. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to spoof SSL servers.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.10:
libnss3 2:3.15.4-0ubuntu0.13.10.1

Ubuntu 12.10:
libnss3 3.15.4-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
libnss3 3.15.4-0ubuntu0.12.04.1

Ubuntu 10.04 LTS:
libnss3-1d 3.15.4-0ubuntu0.10.04.1

After a standard system update you need to restart any applications that use NSS, such as Evolution and Chromium, to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2088-1
CVE-2013-1740

Package Information:
https://launchpad.net/ubuntu/+source/nss/2:3.15.4-0ubuntu0.13.10.1
https://launchpad.net/ubuntu/+source/nss/3.15.4-0ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/nss/3.15.4-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/nss/3.15.4-0ubuntu0.10.04.1

Original Source

Url : http://www.ubuntu.com/usn/USN-2088-1

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-310 Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:22401
 
Oval ID: oval:org.mitre.oval:def:22401
Title: USN-2088-1 -- nss vulnerability
Description: NSS could be made to expose sensitive information over the network.
Family: unix Class: patch
Reference(s): USN-2088-1
CVE-2013-1740
Version: 5
Platform(s): Ubuntu 13.10
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): nss
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 67

Nessus® Vulnerability Scanner

Date Description
2016-05-18 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16716.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-0979.nasl - Type : ACT_GATHER_INFO
2014-10-31 Name : The remote host is affected by multiple vulnerabilities.
File : oracle_opensso_agent_cpu_oct_2014.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140916_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-09-18 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1246.nasl - Type : ACT_GATHER_INFO
2014-09-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO
2014-07-31 Name : The remote host is running software with multiple vulnerabilities.
File : oracle_traffic_director_july_2014_cpu.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0917.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140722_nss_and_nspr_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO
2014-07-18 Name : The remote web server is affected by multiple vulnerabilities.
File : sun_java_web_server_7_0_20.nasl - Type : ACT_GATHER_INFO
2014-07-18 Name : A web proxy server on the remote host is affected by multiple vulnerabilities.
File : iplanet_web_proxy_4_0_24.nasl - Type : ACT_GATHER_INFO
2014-07-18 Name : The remote web server is affected by multiple vulnerabilities.
File : glassfish_cpu_jul_2014.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-119.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2014-1100.nasl - Type : ACT_GATHER_INFO
2014-01-29 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2014-028-02.nasl - Type : ACT_GATHER_INFO
2014-01-24 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2088-1.nasl - Type : ACT_GATHER_INFO
2014-01-21 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-012.nasl - Type : ACT_GATHER_INFO
2014-01-21 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2014-1120.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2016-01-22 09:26:51
  • Multiple Updates
2014-02-17 12:03:01
  • Multiple Updates
2014-01-23 21:19:22
  • First insertion