PT-2014-1455 · Mozilla+5 · Network Security Services+5

Published 2014-03-20 · Updated 2024-12-12 · CVE-2014-1492

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) versions prior to 3.16

Description The issue exists in the cert TestHostName function in lib/certdb/certdb.c, which is part of the certificate-checking implementation. This function accepts a wildcard character embedded in an internationalized domain name's U-label. As a result, it might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. The exploitation of this issue enables attackers to substitute SSL servers using specially formed certificates.

Recommendations For versions prior to 3.16, update to version 3.16 or later to resolve the issue. As a temporary workaround, consider restricting the use of the cert TestHostName function in lib/certdb/certdb.c until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1618

BDU:2015-00420

BDU:2015-00680

CESA-2014_0917

CESA-2014_1073

CVE-2014-1492

DLA-23-1

DSA-2994-1

MGASA-2014-0137

OPENSUSE-SU-2014_0950-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10218-1

OPENSUSE-SU-2024:10451-1

OPENSUSE-SU-2024:14572-1

RHSA-2014:0917

RHSA-2014:1073

RHSA-2014:1246

RHSA-2014_0917

RHSA-2014_1073

RHSA-2014_1246

SUSE-SU-2014_0665-1

SUSE-SU-2014_0665-2

SUSE-SU-2014_0727-1

USN-2159-1

USN-2185-1

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Suse

Ubuntu

References · 3193

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• 🔥 https://hg.mozilla.org/projects/nss/rev/709d4e597979 · Exploit