Netscape NSS Library SSLv2 Challenge Overflow
High Nessus Plugin ID 14361
SynopsisThe remote service is susceptible to a buffer overflow attack.
DescriptionThe remote host seems to be using the Mozilla Network Security Services (NSS) Library, a set of libraries designed to support the development of security-enabled client/server applications.
There seems to be a flaw in the remote version of this library, in the SSLv2 handling code, that may allow an attacker to cause a heap overflow and therefore execute arbitrary commands on the remote host.
To exploit this flaw, an attacker needs to send a malformed SSLv2 'hello' message to the remote service.
SolutionUpgrade the remote service to use NSS 3.9.2 or newer.