PT-2014-2487 · Mozilla+4 · Network Security Services+4

Published 2014-01-18 · Updated 2024-06-15 · CVE-2013-1740

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) versions prior to 3.15.4

Description The issue allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic when the TLS False Start feature is enabled. This is due to a problem in the ssl Do1stHandshake function in sslsecur.c in libssl.

Recommendations For versions prior to 3.15.4, update to version 3.15.4 or later to resolve the issue. As a temporary workaround, consider disabling the TLS False Start feature until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2014-1209

CESA-2014_0917

CVE-2013-1740

MGASA-2014-0024

OPENSUSE-SU-2014_0213-1

OPENSUSE-SU-2024:10451-1

RHSA-2014:0917

RHSA-2014:1246

RHSA-2014_0917

RHSA-2014_1246

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Suse

References · 139

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=919877 · Exploit
• https://bdu.fstec.ru/vul/2014-00284 · Security Note
• https://bdu.fstec.ru/vul/2015-00680 · Security Note
• https://bdu.fstec.ru/vul/2014-00287 · Security Note
• https://bdu.fstec.ru/vul/2014-00235 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1740 · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00289 · Security Note
• https://bdu.fstec.ru/vul/2014-00301 · Security Note
• https://bdu.fstec.ru/vul/2014-00260 · Security Note
• https://bdu.fstec.ru/vul/2014-00236 · Security Note
• https://bdu.fstec.ru/vul/2014-00295 · Security Note
• https://bdu.fstec.ru/vul/2014-00294 · Security Note
• https://bdu.fstec.ru/vul/2014-00258 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1545 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10451-1 · Vendor Advisory