openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)

high Nessus Plugin ID 75685

Language:

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 5.9

Synopsis

The remote openSUSE host is missing a security update.

Description

The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems.

Following security issues were fixed :

 - SSL 2.0 is disabled by default

 - A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong (CVE-2011-3389) is enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.
 bnc#

 - SHA-224 is supported

 - NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db anymore (bmo#641052, bnc#726096) (CVE-2011-3640)

Also following bugs were fixed :

 - fix spec file syntax for qemu-workaround

 - Added a patch to fix errors in the pkcs11n.h header file. (bmo#702090)

 - better SHA-224 support (bmo#647706)

 - SHA-224 is supported

 - Added PORT_ErrorToString and PORT_ErrorToName to return the error message and symbolic name of an NSS error code

 - Added NSS_GetVersion to return the NSS version string

 - Added experimental support of RSA-PSS to the softoken only

Solution

Update the affected nss-201112 packages.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=726096

https://lists.opensuse.org/opensuse-updates/2012-01/msg00009.html

https://lists.opensuse.org/opensuse-updates/2012-01/msg00021.html

Plugin Details

Severity: High

ID: 75685

File Name: suse_11_3_nss-201112-111220.nasl

Version: 1.6

Type: local

Agent: unix

Published: 6/13/2014

Updated: 1/14/2021

Risk Information

Risk Factor: High

VPR Score: 5.9

CVSS v2.0

Base Score: 9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libfreebl3, p-cpe:/a:novell:opensuse:libfreebl3-32bit, p-cpe:/a:novell:opensuse:libsoftokn3, p-cpe:/a:novell:opensuse:libsoftokn3-32bit, p-cpe:/a:novell:opensuse:mozilla-nss, p-cpe:/a:novell:opensuse:mozilla-nss-32bit, p-cpe:/a:novell:opensuse:mozilla-nss-certs, p-cpe:/a:novell:opensuse:mozilla-nss-certs-32bit, p-cpe:/a:novell:opensuse:mozilla-nss-devel, p-cpe:/a:novell:opensuse:mozilla-nss-sysinit, p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-32bit, p-cpe:/a:novell:opensuse:mozilla-nss-tools, cpe:/o:novell:opensuse:11.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 12/20/2011

Reference Information

CVE: CVE-2011-3389, CVE-2011-3640