PT-2013-5077 · Red Hat+2 · Mod Nss+3

Published 2013-12-03 · Updated 2024-06-15 · CVE-2013-4566

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions mod nss versions 1.0.8 and earlier

Description The issue allows remote attackers to bypass intended access restrictions when NSSVerifyClient is set to none for the server/vhost context, and the setting is not enforced in the directory context.

Recommendations For mod nss versions 1.0.8 and earlier, consider updating the configuration to enforce the NSSVerifyClient setting in the directory context to prevent bypassing of access restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2013_1779

CVE-2013-4566

MGASA-2013-0381

OPENSUSE-SU-2024:10311-1

RHSA-2013:1779

RHSA-2013_1779

SUSE-SU-2013_1926-1

SUSE-SU-2016:2285-1

SUSE-SU-2016:2329-1

SUSE-SU-2016:2396-1

SUSE-SU-2016_2285-1

SUSE-SU-2016_2329-1

SUSE-SU-2016_2396-1

Affected Products

Centos

Red Hat

Suse

Mod Nss

References · 52

• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4566 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4566 · Security Note
• https://bdu.fstec.ru/vul/2015-00642 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10311-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1779.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4566 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2285-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0381.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2396-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4566 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1779.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4566 · Vendor Advisory