PT-2014-1455 · Mozilla+5 · Network Security Services+5
Publicado
2014-03-20
·
Atualizado
2024-12-12
·
CVE-2014-1492
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Network Security Services (NSS) versions prior to 3.16
Description
The issue exists in the cert TestHostName function in lib/certdb/certdb.c, which is part of the certificate-checking implementation. This function accepts a wildcard character embedded in an internationalized domain name's U-label. As a result, it might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. The exploitation of this issue enables attackers to substitute SSL servers using specially formed certificates.
Recommendations
For versions prior to 3.16, update to version 3.16 or later to resolve the issue. As a temporary workaround, consider restricting the use of the cert TestHostName function in lib/certdb/certdb.c until a patch is available.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Network Security Services
Red Hat
Suse
Ubuntu