PT-2012-2072 · Mozilla · Network Security Services

Published 2012-06-16 · Updated 2025-09-22 · CVE-2011-5094

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) versions 3.x

Description The issue is related to the SSL ENABLE RENEGOTIATION option in certain settings, which does not properly restrict client-initiated renegotiation within the SSL and TLS protocols. This could allow remote attackers to cause a denial of service by performing many renegotiations within a single connection, leading to CPU consumption.

Recommendations For Mozilla Network Security Services (NSS) versions 3.x, consider disabling the SSL ENABLE RENEGOTIATION option or limiting renegotiation when it is inappropriate within a specific environment to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2011-5094

Affected Products

Network Security Services

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2011-5094 · Security Note
• https://t.me/cvenotify/12164 · Telegram Post
• http://ietf.org/mail-archive/web/tls/current/msg07576.html · Note
• http://educatedguesswork.org/2011/10/ssltls_and_computational_dos.html · Note
• http://orchilles.com/2011/03/ssl-renegotiation-dos.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=707065 · Note
• https://t.me/cvenotify/11158 · Telegram Post
• https://t.me/cvenotify/89533 · Telegram Post
• http://ietf.org/mail-archive/web/tls/current/msg07564.html · Note
• https://t.me/cvenotify/89542 · Telegram Post
• http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html · Note
• http://ietf.org/mail-archive/web/tls/current/msg07567.html · Note
• http://ietf.org/mail-archive/web/tls/current/msg07577.html · Note
• http://ietf.org/mail-archive/web/tls/current/msg07553.html · Note
• http://openwall.com/lists/oss-security/2011/07/08/2 · Note