Vulnerability Note VU#592796
Mozilla Network Security Services (NSS) fails to properly handle the client master key
A vulnerability in the way Mozilla Network Security Services (NSS) handles the client master key may lead to execution of arbitrary code.
The SSLv2 protocol uses a client master key to generate all subsequent session keys. The validity of the client master key is determined during phase one of the SSL handshake. Mozilla NSS library contains a vulnerability in the way client master keys with invalid length values are handled that may result in a buffer overflow. According to the Mozilla Foundation Security Advisory (MFSA) 2007-06:
Servers that use NSS for the SSLv2 protocol can be exploited by a client that presents a "Client Master Key" with invalid length values in any of several fields that are used without adequate error checking. This can lead to a buffer overflow that presumably could be exploitable.
Note that this vulnerability may affect any application that uses the Mozilla NSS library.
A remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user who is running the vulnerable application or cause a denial of service.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Fedora Project||Affected||-||07 Mar 2007|
|Gentoo Linux||Affected||-||05 Apr 2007|
|Mandriva, Inc.||Affected||-||07 Mar 2007|
|Mozilla||Affected||-||27 Feb 2007|
|Red Hat, Inc.||Affected||-||07 Mar 2007|
|rPath||Affected||-||07 Mar 2007|
|Slackware Linux Inc.||Affected||-||05 Apr 2007|
|Sun Microsystems, Inc.||Affected||-||05 Apr 2007|
|SUSE Linux||Affected||-||07 Mar 2007|
|Ubuntu||Affected||-||07 Mar 2007|
CVSS Metrics (Learn More)
This vulnerability was reported in Mozilla Foundation Security Advisory 2007-06. Mozilla credits iDefense with reporting this issue.
This document was written by Chris Taschner.
- CVE IDs: CVE-2007-0009
- Date Public: 23 Feb 2007
- Date First Published: 07 Mar 2007
- Date Last Updated: 05 Apr 2007
- Severity Metric: 12.72
- Document Revision: 57
If you have feedback, comments, or additional information about this vulnerability, please send us email.