GLSA-200703-22 : Mozilla Network Security Service: Remote execution of arbitrary code

Medium Nessus Plugin ID 24888

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200703-22 (Mozilla Network Security Service: Remote execution of arbitrary code)

iDefense has reported two potential buffer overflow vulnerabilities found by researcher 'regenrecht' in the code implementing the SSLv2 protocol.
Impact :

A remote attacker could send a specially crafted SSL master key to a server using NSS for the SSLv2 protocol, or entice a user to connect to a malicious server with a client-side application using NSS like one of the Mozilla products. This could trigger the vulnerabilities and result in the possible execution of arbitrary code with the rights of the vulnerable application.
Workaround :

Disable the SSLv2 protocol in the applications using NSS.

Solution

All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-libs/nss-3.11.5'

See Also

https://security.gentoo.org/glsa/200703-22

Plugin Details

Severity: Medium

ID: 24888

File Name: gentoo_GLSA-200703-22.nasl

Version: 1.14

Type: local

Published: 2007/03/26

Updated: 2018/07/11

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:nss, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2007/03/20

Vulnerability Publication Date: 2007/02/23

Reference Information

CVE: CVE-2007-0008, CVE-2007-0009

GLSA: 200703-22

CWE: 119, 189