PT-2013-5676 · Mozilla+4 · Network Security Services+4

Published 2013-11-15 · Updated 2018-10-09 · CVE-2013-5606

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) versions 3.15 through 3.15.2

Description The issue is related to the CERT VerifyCert function in lib/certhigh/certvfy.c, which provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid. This might allow remote attackers to bypass intended access restrictions via a crafted certificate.

Recommendations For Mozilla Network Security Services (NSS) versions 3.15 through 3.15.2, update to version 3.15.3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2013-1148

CESA-2013_1829

CVE-2013-5606

DLA-23-1

DSA-2994-1

MGASA-2013-0337

RHSA-2013:1791

RHSA-2013:1829

RHSA-2013_1791

RHSA-2013_1829

RHSA-2014:0041

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Suse

References · 63

• https://bdu.fstec.ru/vul/2015-02928 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-5606 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1829.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0337 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-5606 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2013-103 · Vendor Advisory
• http://debian.org/security/2014/dsa-2994 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2013-1148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5606 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0041.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605 · Security Note
• https://advisories.mageia.org/MGASA-2013-0337.html · Security Note
• http://security.gentoo.org/glsa/glsa-201406-19.xml · Vendor Advisory