Detections
Analytics

Mandriva Linux Security Advisory : nss (MDVSA-2014:139)

critical Nessus Plugin ID 76885

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

A vulnerability has been found and corrected in mozilla NSS :

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

The updated packages have been upgraded to the latest NSS (3.16.3) versions which is not vulnerable to this issue.

The nss 3.16.1 update done as part of MDVSA-2014:125 introduced a regression because of the upstream change: 'Imposed name constraints on the French government root CA ANSSI (DCISS)' The change wont work as currently implemented as the French government root CA signs more than 'gouv.fr' domains. So for now we revert that change until its properly fixed upstream (mga#13563).

Additionally the rootcerts package has also been updated to the latest version as of 2014-07-03, which adds, removes, and distrusts several certificates.

Solution

Update the affected packages.

See Also

http://advisories.mageia.org/MGAA-2014-0135.html

https://bugs.mageia.org/show_bug.cgi?id=13563

http://www.nessus.org/u?a9bc9e12

http://www.nessus.org/u?d0ee8a6e

https://www.mozilla.org/security/announce/2014/mfsa2014-63.html

Plugin Details

Severity: Critical

ID: 76885

File Name: mandriva_MDVSA-2014-139.nasl

Version: 1.7

Type: local

Published: 7/30/2014

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:rootcerts, p-cpe:/a:mandriva:linux:rootcerts-java, cpe:/o:mandriva:business_server:1, p-cpe:/a:mandriva:linux:lib64nss-devel, p-cpe:/a:mandriva:linux:lib64nss-static-devel, p-cpe:/a:mandriva:linux:lib64nss3, p-cpe:/a:mandriva:linux:nss, p-cpe:/a:mandriva:linux:nss-doc

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 7/29/2014

Reference Information

CVE: CVE-2014-1544

BID: 68816

MDVSA: 2014:139