Debian DSA-3688-1 : nss - security update (Logjam) (SLOTH)

High Nessus Plugin ID 93871

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project.

- CVE-2015-4000 David Adrian et al. reported that it may be feasible to attack Diffie-Hellman-based cipher suites in certain circumstances, compromising the confidentiality and integrity of data encrypted with Transport Layer Security (TLS).

- CVE-2015-7181 CVE-2015-7182 CVE-2016-1950 Tyson Smith, David Keeler, and Francis Gabriel discovered heap-based buffer overflows in the ASN.1 DER parser, potentially leading to arbitrary code execution.

- CVE-2015-7575 Karthikeyan Bhargavan discovered that TLS client implementation accepted MD5-based signatures for TLS 1.2 connections with forward secrecy, weakening the intended security strength of TLS connections.

- CVE-2016-1938 Hanno Boeck discovered that NSS miscomputed the result of integer division for certain inputs. This could weaken the cryptographic protections provided by NSS.
However, NSS implements RSA-CRT leak hardening, so RSA private keys are not directly disclosed by this issue.

- CVE-2016-1978 Eric Rescorla discovered a use-after-free vulnerability in the implementation of ECDH-based TLS handshakes, with unknown consequences.

- CVE-2016-1979 Tim Taubert discovered a use-after-free vulnerability in ASN.1 DER processing, with application-specific impact.

- CVE-2016-2834 Tyson Smith and Jed Davis discovered unspecified memory-safety bugs in NSS.

In addition, the NSS library did not ignore environment variables in processes which underwent a SUID/SGID/AT_SECURE transition at process start. In certain system configurations, this allowed local users to escalate their privileges.

This update contains further correctness and stability fixes without immediate security impact.

Solution

Upgrade the nss packages.

For the stable distribution (jessie), these problems have been fixed in version 2:3.26-1+debu8u1.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583651

https://security-tracker.debian.org/tracker/CVE-2015-4000

https://security-tracker.debian.org/tracker/CVE-2015-7181

https://security-tracker.debian.org/tracker/CVE-2015-7182

https://security-tracker.debian.org/tracker/CVE-2016-1950

https://security-tracker.debian.org/tracker/CVE-2015-7575

https://security-tracker.debian.org/tracker/CVE-2016-1938

https://security-tracker.debian.org/tracker/CVE-2016-1978

https://security-tracker.debian.org/tracker/CVE-2016-1979

https://security-tracker.debian.org/tracker/CVE-2016-2834

https://packages.debian.org/source/jessie/nss

https://www.debian.org/security/2016/dsa-3688

Plugin Details

Severity: High

ID: 93871

File Name: debian_DSA-3688.nasl

Version: 2.6

Type: local

Agent: unix

Published: 2016/10/06

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:nss, cpe:/o:debian:debian_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/10/05

Reference Information

CVE: CVE-2015-4000, CVE-2015-7181, CVE-2015-7182, CVE-2015-7575, CVE-2016-1938, CVE-2016-1950, CVE-2016-1978, CVE-2016-1979, CVE-2016-2834

DSA: 3688