RHEL 6 : nss, nss-util, and nspr (RHSA-2012:0973)

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated nss, nss-util, and nspr packages that fix one security issue,
several bugs, and add various enhancements are now available for Red
Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
moderate security impact.

Network Security Services (NSS) is a set of libraries designed to
support the cross-platform development of security-enabled client and
server applications. Netscape Portable Runtime (NSPR) provides
platform independence for non-GUI operating system facilities.

It was found that a Certificate Authority (CA) issued a subordinate CA
certificate to its customer, that could be used to issue certificates
for any name. This update renders the subordinate CA certificate as
untrusted. (BZ#798533)

Note: This fix only applies to applications using the NSS Builtin
Object Token. It does not render the certificates untrusted for
applications that use the NSS library, but do not use the NSS Builtin
Object Token.

The nspr package has been upgraded to upstream version 4.9, which
provides a number of bug fixes and enhancements over the previous
version. (BZ#799193)

The nss-util package has been upgraded to upstream version 3.13.3,
which provides a number of bug fixes and enhancements over the
previous version. (BZ#799192)

The nss package has been upgraded to upstream version 3.13.3, which
provides numerous bug fixes and enhancements over the previous
version. In particular, SSL 2.0 is now disabled by default, support
for SHA-224 has been added, PORT_ErrorToString and PORT_ErrorToName
now return the error message and symbolic name of an NSS error code,
and NSS_GetVersion now returns the NSS version string. (BZ#744070)

These updated nss, nss-util, and nspr packages also provide fixes for
the following bugs :

* A PEM module internal function did not clean up memory when
detecting a non-existent file name. Consequently, memory leaks in
client code occurred. The code has been improved to deallocate such
temporary objects and as a result the reported memory leakage is gone.
(BZ#746632)

* Recent changes to NSS re-introduced a problem where applications
could not use multiple SSL client certificates in the same process.
Therefore, any attempt to run commands that worked with multiple SSL
client certificates, such as the 'yum repolist' command, resulted in a
re-negotiation handshake failure. With this update, a revised patch
correcting this problem has been applied to NSS, and using multiple
SSL client certificates in the same process is now possible again.
(BZ#761086)

* The PEM module did not fully initialize newly constructed objects
with function pointers set to NULL. Consequently, a segmentation
violation in libcurl was sometimes experienced while accessing a
package repository. With this update, the code has been changed to
fully initialize newly allocated objects. As a result, updates can now
be installed without problems. (BZ#768669)

* A lack-of-robustness flaw caused the administration server for Red
Hat Directory Server to terminate unexpectedly because the mod_nss
module made nss calls before initializing nss as per the documented
API. With this update, nss protects itself against being called before
it has been properly initialized by the caller. (BZ#784674)

* Compilation errors occurred with some compilers when compiling code
against NSS 3.13.1. The following error message was displayed :

pkcs11n.h:365:26: warning: '__GNUC_MINOR' is not defined

An upstream patch has been applied to improve the code and the problem
no longer occurs. (BZ#795693)

* Unexpected terminations were reported in the messaging daemon
(qpidd) included in Red Hat Enterprise MRG after a recent update to
nss. This occurred because qpidd made nss calls before initializing
nss. These updated packages prevent qpidd and other affected processes
that call nss without initializing as mandated by the API from
crashing. (BZ#797426)

Users of NSS, NSPR, and nss-util are advised to upgrade to these
updated packages, which fix these issues and add these enhancements.
After installing this update, applications using NSS, NSPR, or
nss-util must be restarted for this update to take effect.

See also :

http://rhn.redhat.com/errata/RHSA-2012-0973.html

Solution :

Update the affected packages.

Risk factor :

High

Family: Red Hat Local Security Checks

Nessus Plugin ID: 59599 ()

Bugtraq ID:

CVE ID: