Executive Summary
| Summary | |
|---|---|
| Title | NSPR vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-2265-1 | First vendor Publication | 2014-07-02 |
| Vendor | Ubuntu | Last vendor Modification | 2014-07-02 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 13.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: NSPR could be made to crash or run programs if it received specially crafted input. Software Description: - nspr: NetScape Portable Runtime Library Details: Abhishek Arya discovered that NSPR incorrectly handled certain console functions. A remote attacker could use this issue to cause NSPR to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: Ubuntu 13.10: Ubuntu 12.04 LTS: Ubuntu 10.04 LTS: After a standard system update you need to restart your session to make all the necessary changes. References: Package Information: |
Original Source
| Url : http://www.ubuntu.com/usn/USN-2265-1 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24891 | |||
| Oval ID: | oval:org.mitre.oval:def:24891 | ||
| Title: | DSA-2960-1 icedove - security update | ||
| Description: | Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2960-1 CVE-2014-1533 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | icedove |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24988 | |||
| Oval ID: | oval:org.mitre.oval:def:24988 | ||
| Title: | DSA-2962-1 nspr - security update | ||
| Description: | Abhiskek Arya discovered an out of bounds write in the cvt_t() function of the NetScape Portable Runtime Library which could result in the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2962-1 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | nspr |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25038 | |||
| Oval ID: | oval:org.mitre.oval:def:25038 | ||
| Title: | DSA-2955-1 iceweasel - security update | ||
| Description: | Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2955-1 CVE-2014-1533 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25053 | |||
| Oval ID: | oval:org.mitre.oval:def:25053 | ||
| Title: | USN-2265-1 -- nspr vulnerability | ||
| Description: | NSPR could be made to crash or run programs if it received specially crafted input. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2265-1 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 13.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | nspr |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25116 | |||
| Oval ID: | oval:org.mitre.oval:def:25116 | ||
| Title: | RHSA-2014:0917: nss and nspr security, bug fix, and enhancement update (Critical) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135) Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:0917-00 CESA-2014:0917 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1544 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | nspr nss nss-util |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26119 | |||
| Oval ID: | oval:org.mitre.oval:def:26119 | ||
| Title: | ELSA-2014-1246 -- nss and nspr security, bug fix, and enhancement update (Moderate) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-1246 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Oracle Linux 5 | Product(s): | nss |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:26451 | |||
| Oval ID: | oval:org.mitre.oval:def:26451 | ||
| Title: | RHSA-2014:1246: nss and nspr security, bug fix, and enhancement update (Moderate) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1246-00 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1545 CESA-2014:1246 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26703 | |||
| Oval ID: | oval:org.mitre.oval:def:26703 | ||
| Title: | RHSA-2014:1047: nss nad nspr bug fix and enhancement update (Moderate) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1047-00 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27117 | |||
| Oval ID: | oval:org.mitre.oval:def:27117 | ||
| Title: | ELSA-2014-0917 -- nss and nspr security, bug fix, and enhancement update (critical) | ||
| Description: | nspr [4.10.6-1] - Rebase to nspr-4.10.6 - Resolves: rhbz#1112135 nss [3.16.1-4.0.1.el6_5] - Added nss-vendor.patch to change vendor [3.16.1-4] - Update some patches on account of the rebase - Resolves: Bug 1099619 [3.16.1-3] - Backport nss-3.12.6 upstream fix required by Firefox 31 - Resolves: Bug 1099619 [3.16.1-2] - Remove two unused patches and apply a needed one that was missed - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1 [3.16.1-1] - Update to nss-3.16.1 - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1 nss-util [3.15.6-1] - Update to nss-3.16.1 - Resolves: rhbz#1112136 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-0917 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1544 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Oracle Linux 6 | Product(s): | nspr nss nss-util |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2014-06-12 | IAVM : 2014-A-0082 - Multiple Vulnerabilities in Mozilla Products Severity : Category I - VMSKEY : V0052487 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-05-18 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16716.nasl - Type : ACT_GATHER_INFO |
| 2015-04-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201504-01.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-32.nasl - Type : ACT_GATHER_INFO |
| 2015-03-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-059.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-0979.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-384.nasl - Type : ACT_GATHER_INFO |
| 2014-10-01 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140916_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-09-18 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1246.nasl - Type : ACT_GATHER_INFO |
| 2014-09-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140722_nss_and_nspr_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0917.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO |
| 2014-07-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2265-1.nasl - Type : ACT_GATHER_INFO |
| 2014-07-02 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-448.nasl - Type : ACT_GATHER_INFO |
| 2014-07-02 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-447.nasl - Type : ACT_GATHER_INFO |
| 2014-06-23 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_Firefox-2014-06-140612.nasl - Type : ACT_GATHER_INFO |
| 2014-06-23 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-432.nasl - Type : ACT_GATHER_INFO |
| 2014-06-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2962.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2960.nasl - Type : ACT_GATHER_INFO |
| 2014-06-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-125.nasl - Type : ACT_GATHER_INFO |
| 2014-06-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2955.nasl - Type : ACT_GATHER_INFO |
| 2014-06-11 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_888a0262f0d911e3ba0cb4b52fce4ce8.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-07-04 13:24:52 |
|
| 2014-07-02 21:22:22 |
|
