The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.

According to its self-reported version, the Oracle iPlanet Web Server (formerly known as Sun Java System Web Server) running on the remote host is 6.1.x prior to 6.1.21 or 7.0.x prior to 7.0.22. It is, therefore, affected by a flaw in the definite_length_decoder() function in the Network Security Services (NSS) library due to a failure to ensure that the DER encoding of an ASN.1 length is properly formed when handling PKCS#1 signatures. A remote attacker, by using a long byte sequence for an encoding, can exploit this to conduct a data-smuggling attack or inject arbitrary code.

According to its self-reported version, the Oracle iPlanet Web Proxy Server (formerly known as Sun Java System Web Proxy Server) installed on the remote host is version 4.0.x prior to 4.0.26. It is, therefore, affected by a flaw in the definite_length_decoder() function in the Network Security Services (NSS) library due to a failure to ensure that the DER encoding of an ASN.1 length is properly formed when handling PKCS#1 signatures. A remote attacker, by using a long byte sequence for an encoding, can exploit this to conduct a data-smuggling attack or inject arbitrary code.

The version of Oracle GlassFish Server running on the remote host is affected by multiple vulnerabilities :

  - A security bypass vulnerability exists in the bundled     Network Security Services (NSS) library because the     definite_length_decoder() function, in file quickder.c,     does not properly form the DER encoding of an ASN.1     length. A remote attacker, by using a long byte sequence     for an encoding, can exploit this issue to conduct     undetected smuggling of arbitrary data. (CVE-2014-1569)

  - An unspecified flaw exists related to the Java Server     Faces subcomponent. A remote attacker can exploit this     to affect the integrity of the system. (CVE-2015-2623)

  - An unspecified flaw exists related to the Java Server     Faces and Web Container subcomponents. A remote attacker     can exploit this to affect the integrity of the system.
    (CVE-2015-4744)

Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues.

Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificates list.

For more information, please refer to https://www.mozilla.org/en-US/security/advisories/ .

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues.

Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list.

For more information, please see https://www.mozilla.org/en-US/security/advisories/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues in MozillaFirefox :

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889,     bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538,     bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871,     bmo#1098583) Miscellaneous memory safety hazards     (rv:35.0 / rv:31.4)

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

  - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free     in WebRTC

Also Mozilla NSS was updated to 3.17.3 to fix :

  - The QuickDER decoder now decodes lengths robustly     (bmo#1064670/CVE-2014-1569)

  - Support for TLS_FALLBACK_SCSV has been added to the     ssltap and tstclnt utilities

  - Changes in CA certificates

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

nss 3.12.8-1+squeeze11 fixes two security issues :

CVE-2011-3389

SSL 3.0 and TLS 1.0 connections were vulnerable to some chosen plaintext attacks which allowed man-in-the middle attackers to obtain plaintext HTTP headers on an HTTPS session. This issue is known as the 'BEAST' attack.

CVE-2014-1569

Possible information leak with too-permissive ASN.1 DER decoding of length.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages :

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate (CVE-2014-1492).

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a signature malleability issue (CVE-2014-1568).

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00 (CVE-2014-1569).

Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545).

The sqlite3 packages have been upgraded to the 3.8.6 version due to an prerequisite to nss-3.17.x.

Additionally the rootcerts package has also been updated to the latest version as of 2014-11-17, which adds, removes, and distrusts several certificates.

The updated packages provides a solution for these security issues.

It was discovered that the Mozilla Network Security Service library (nss) incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack.

MozillaFirefox, mozilla-nss were updated to fix 18 security issues.

MozillaFirefox was updated to version 36.0. These security issues were fixed :

  - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory     safety hazards

  - CVE-2015-0832: Appended period to hostnames can bypass     HPKP and HSTS protections

  - CVE-2015-0830: Malicious WebGL content crash when     writing strings

  - CVE-2015-0834: TLS TURN and STUN connections silently     fail to simple TCP connections

  - CVE-2015-0831: Use-after-free in IndexedDB

  - CVE-2015-0829: Buffer overflow in libstagefright during     MP4 video playback

  - CVE-2015-0828: Double-free when using non-default memory     allocators with a zero-length XHR

  - CVE-2015-0827: Out-of-bounds read and write while     rendering SVG content

  - CVE-2015-0826: Buffer overflow during CSS restyling

  - CVE-2015-0825: Buffer underflow during MP3 playback

  - CVE-2015-0824: Crash using DrawTarget in Cairo graphics     library

  - CVE-2015-0823: Use-after-free in Developer Console date     with OpenType Sanitiser

  - CVE-2015-0822: Reading of local files through     manipulation of form autocomplete

  - CVE-2015-0821: Local files or privileged URLs in pages     can be opened into new tabs

  - CVE-2015-0819: UI Tour whitelisted sites in background     tab can spoof foreground tabs

  - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass

mozilla-nss was updated to version 3.17.4 to fix the following issues :

  - CVE-2014-1569: QuickDER decoder length issue     (bnc#910647).

  - bmo#1084986: If an SSL/TLS connection fails, because     client and server don't have any common protocol version     enabled, NSS has been changed to report error code     SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting     SSL_ERROR_NO_CYPHER_OVERLAP).

  - bmo#1112461: libpkix was fixed to prefer the newest     certificate, if multiple certificates match.

  - bmo#1094492: fixed a memory corruption issue during     failure of keypair generation.

  - bmo#1113632: fixed a failure to reload a PKCS#11 module     in FIPS mode.

  - bmo#1119983: fixed interoperability of NSS server code     with a LibreSSL client.

Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues.

Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list.

For more information, please see https://www.mozilla.org/en-US/security/advisories/

It was discovered that NSS incorrectly handled certain ASN.1 lengths.
A remote attacker could possibly use this issue to perform a data-smuggling attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update the nss, nss-softokn, and nss-util packages to nss-3.17.3

For more details on the bugs fixed with this release, please see the upstream release notes at

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17 .3_release_notes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated nss package fixes a conflict among the nss-tools pp man page an the similarly named one from perl-PAR_Packager.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated nss packages fix security vulnerabilities :

In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data (CVE-2014-1569).

This update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE.

The Mozilla Project reports :

ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data

MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory

MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer

MFSA-2014-88 Buffer overflow while parsing media content

MFSA-2014-87 Use-after-free during HTML5 parsing

MFSA-2014-86 CSP leaks redirect data via violation reports

MFSA-2014-85 XMLHttpRequest crashes with some input streams

MFSA-2014-84 XBL bindings accessible via improper CSS declarations

MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)

The version of Thunderbird installed on the remote Windows host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.3. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

The version of Thunderbird installed on the remote Mac OS X host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

  - An information disclosure vulnerability exists due to     the CoreGraphic framework creating log files containing     sensitive information in the '/tmp' directory.
    (CVE-2014-1595)

The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

  - An information disclosure vulnerability exists due to     the CoreGraphic framework creating log files containing     sensitive information in the '/tmp' directory.
    (CVE-2014-1595)

ID	Name	Product	Family	Severity
84963	Oracle iPlanet Web Server 6.1.x < 6.1.21 / 7.0.x < 7.0.22 NSS Signature Handling Remote Code Injection	Nessus	Web Servers	high
84962	Oracle iPlanet Web Proxy Server 4.0.x < 4.0.26 NSS Signature Handling Remote Code Injection	Nessus	Windows	high
84810	Oracle GlassFish Server Multiple Vulnerabilities (July 2015 CPU)	Nessus	Web Servers	high
83677	SUSE SLES11 Security Update : Mozilla Firefox (SUSE-SU-2015:0173-1)	Nessus	SuSE Local Security Checks	high
83676	SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:0171-1)	Nessus	SuSE Local Security Checks	high
83666	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1)	Nessus	SuSE Local Security Checks	high
82137	Debian DLA-154-1 : nss security update (BEAST)	Nessus	Debian Local Security Checks	high
81942	Mandriva Linux Security Advisory : nss (MDVSA-2015:059)	Nessus	Mandriva Local Security Checks	critical
81830	Debian DSA-3186-1 : nss - security update	Nessus	Debian Local Security Checks	high
81589	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185)	Nessus	SuSE Local Security Checks	high
81123	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)	Nessus	SuSE Local Security Checks	high
81122	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)	Nessus	SuSE Local Security Checks	high
80410	Ubuntu 14.04 LTS : NSS vulnerability (USN-2452-1)	Nessus	Ubuntu Local Security Checks	high
80402	Fedora 20 : nss-3.17.3-2.fc20 / nss-softokn-3.17.3-1.fc20 / nss-util-3.17.3-1.fc20 (2014-16530)	Nessus	Fedora Local Security Checks	high
80236	Fedora 21 : nss-3.17.3-2.fc21 (2014-17085)	Nessus	Fedora Local Security Checks	high
80041	Mandriva Linux Security Advisory : nss (MDVSA-2014:252)	Nessus	Mandriva Local Security Checks	high
79707	FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)	Nessus	FreeBSD Local Security Checks	high
79666	Mozilla Thunderbird < 31.3 Multiple Vulnerabilities	Nessus	Windows	high
79665	Firefox < 34.0 Multiple Vulnerabilities	Nessus	Windows	high
79664	Firefox ESR 31.x < 31.3 Multiple Vulnerabilities	Nessus	Windows	high
79663	Mozilla Thunderbird < 31.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
79662	Firefox < 34.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2014-1569

high

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high