The Mozilla NSS security framework was updated to version 3.12.3.1.

CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

MFSA 2009-42 / CVE-2009-2408: IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target.
These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions. This vulnerability was independently reported to us by researcher Moxie Marlinspike who also noted that since Firefox relies on SSL to protect the integrity of security updates this attack could be used to serve malicious updates.

CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky) CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly CVE-2009-2404 nss regexp heap overflow

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing, calendar time, basic memory management (malloc and free), and shared library linking.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSLv2, SSLv3, TLS, and other security standards.

These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version 3.12.4. The version of NSPR has also been upgraded from 4.7.3 to 4.7.4.

Moxie Marlinspike reported a heap overflow flaw in a regular expression parser in the NSS library used by browsers such as Mozilla Firefox to match common names in certificates. A malicious website could present a carefully-crafted certificate in such a way as to trigger the heap overflow, leading to a crash or, possibly, arbitrary code execution with the permissions of the user running the browser.
(CVE-2009-2404)

Note: in order to exploit this issue without further user interaction in Firefox, the carefully-crafted certificate would need to be signed by a Certificate Authority trusted by Firefox, otherwise Firefox presents the victim with a warning that the certificate is untrusted.
Only if the user then accepts the certificate will the overflow take place.

Dan Kaminsky discovered flaws in the way browsers such as Firefox handle NULL characters in a certificate. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authority trusted by Firefox, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Firefox into accepting it by mistake. (CVE-2009-2408)

Dan Kaminsky found that browsers still accept certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to create a malicious certificate that would be treated as trusted by a browser. NSS now disables the use of MD2 and MD4 algorithms inside signatures by default. (CVE-2009-2409)

These version upgrades also provide a fix for the following bug :

  - SSL client authentication failed against an Apache     server when it was using the mod_nss module and     configured for NSSOCSP. On the client side, the user     agent received an error message that referenced 'Error     Code :

  - -12271' and stated that establishing an encrypted     connection had failed because the certificate had been     rejected by the host.

On the server side, the nss_error_log under /var/log/httpd/ contained the following message :

[error] Re-negotiation handshake failed: Not accepted by client!?

Also, /var/log/httpd/error_log contained this error :

SSL Library Error: -8071 The OCSP server experienced an internal error

With these updated packages, the dependency problem which caused this failure has been resolved so that SSL client authentication with an Apache web server using mod_nss which is configured for NSSOCSP succeeds as expected. Note that if the presented client certificate is expired, then access is denied, the user agent is presented with an error message about the invalid certificate, and the OCSP queries are seen in the OCSP responder. Also, similar OCSP status verification happens for SSL server certificates used in Apache upon instance start or restart. (BZ#508027)

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3072, CVE-2009-3075)

A use-after-free flaw was found in SeaMonkey. An attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3077)

Dan Kaminsky discovered flaws in the way browsers such as SeaMonkey handle NULL characters in a certificate. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authority trusted by SeaMonkey, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse SeaMonkey into accepting it by mistake. (CVE-2009-2408)

Descriptions in the dialogs when adding and removing PKCS #11 modules were not informative. An attacker able to trick a user into installing a malicious PKCS #11 module could use this flaw to install their own Certificate Authority certificates on a user's machine, making it possible to trick the user into believing they are viewing a trusted site or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3076)

A flaw was found in the way SeaMonkey displays the address bar when window.open() is called in a certain way. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2009-2654)

Dan Kaminsky found that browsers still accept certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to create a malicious certificate that would be treated as trusted by a browser. NSS (provided by SeaMonkey) now disables the use of MD2 and MD4 algorithms inside signatures by default.
(CVE-2009-2409)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

seamonkey was updated to version 1.1.18, fixing various security issues :

MFSA 2009-43 / CVE-2009-2404 Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names. This vulnerability could be used to compromise the browser and run arbitrary code by presenting a specially crafted certificate to the client. This code provided compatibility with the non-standard regular expression syntax historically supported by Netscape clients and servers. With version 3.5 Firefox switched to the more limited industry-standard wildcard syntax instead and is not vulnerable to this flaw. 

MFSA 2009-42 / CVE-2009-2408: IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target.
These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions. This vulnerability was independently reported to us by researcher Moxie Marlinspike who also noted that since Firefox relies on SSL to protect the integrity of security updates this attack could be used to serve malicious updates.
Mozilla would like to thank Dan and the Microsoft Vulnerability Research team for coordinating a multiple-vendor response to this problem.

The update also contains the fixes from the skipped 1.1.17 security update: MFSA 2009-17/CVE-2009-1307: Same-origin violations when Adobe Flash loaded via view-source: scheme 

MFSA 2009-21/CVE-2009-1311:POST data sent to wrong site when saving web page with embedded frame 

MFSA 2009-24/CVE-2009-1392/CVE-2009-1832/CVE-2009-1833: Crashes with evidence of memory corruption (rv:1.9.0.11) 

MFSA 2009-26/CVE-2009-1835: Arbitrary domain cookie access by local file: resources 

MFSA 2009-27/CVE-2009-1836: SSL tampering via non-200 responses to proxy CONNECT requests 

MFSA 2009-29/CVE-2009-1838: Arbitrary code execution using event listeners attached to an element whose owner document is null 

MFSA 2009-32/CVE-2009-1841: JavaScript chrome privilege escalation MFSA 2009-33/CVE-2009-2210: Crash viewing multipart/alternative message with text/enhanced part

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2009-006 applied.

This security update contains fixes for the following products :

  - AFP Client
  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - ATS
  - Certificate Assistant
  - CoreGraphics
  - CUPS
  - Dictionary
  - DirectoryService
  - Disk Images
  - Event Monitor
  - fetchmail
  - FTP Server
  - Help Viewer
  - International Components for Unicode
  - IOKit
  - IPSec
  - libsecurity
  - libxml
  - OpenLDAP
  - OpenSSH
  - PHP
  - QuickDraw Manager
  - QuickLook
  - FreeRADIUS
  - Screen Sharing
  - Spotlight
  - Subversion

a. Update for Service Console packages nss and nspr

   Service console packages for Network Security Services (NSS) and    NetScape Portable Runtime (NSPR) are updated to versions    nss-3.12.3.99.3-1.2157 and nspr-4.7.6-1.2213 respectively. This    patch fixes several security issues in the service console    packages for NSS and NSPR.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-2409, CVE-2009-2408, CVE-2009-2404,    CVE-2009-1563, CVE-2009-3274, CVE-2009-3370, CVE-2009-3372,    CVE-2009-3373, CVE-2009-3374, CVE-2009-3375, CVE-2009-3376,    CVE-2009-3380, and CVE-2009-3382 to these issues.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Network Security Services (NSS)
  - NetScape Portable Runtime (NSPR)

The remote host is running a version of SeaMonkey earlier than 1.1.18.  Such versions are potentially affected by multiple vulnerabilities : 

  - A heap overflow vulnerability in the code that handles regular expressions in certificate names. (MFSA-2009-43)

  - A mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities which issue server certificates. (MFSA-2009-42)

Versions of Mozilla Thunderbird prior to 2.0.0.23 are affected by an SSL spoofing attack. The client can be fooled into trusting a malicious SSL server certificate with a null character in the host name. (MFSA 2009-42)

The installed version of Firefox is earlier than 3.0.13/3.5.0. Such versions are reportedly potentially affected by the following security issues : 

 - The browser can be fooled into trusting a malicious SSL server certificate with a null character in the host name. (MFSA 2009-42)
 - A heap overflow in the code that handles regular expressions in certificate names can lead to arbitrary code execution. (MFSA 2009-43)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

ID	Name	Product	Family	Published	Updated	Severity
40652	openSUSE Security Update : libfreebl3 (libfreebl3-1201)	Nessus	SuSE Local Security Checks	8/20/2009	1/14/2021	high
60631	Scientific Linux Security Update : nspr and nss for SL 4.x on i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
40923	RHEL 3 : seamonkey (RHSA-2009:1432)	Nessus	Red Hat Local Security Checks	9/10/2009	1/14/2021	critical
42202	openSUSE Security Update : seamonkey (seamonkey-1364)	Nessus	SuSE Local Security Checks	10/22/2009	1/14/2021	high
42206	openSUSE Security Update : seamonkey (seamonkey-1364)	Nessus	SuSE Local Security Checks	10/22/2009	1/14/2021	high
42433	Mac OS X Multiple Vulnerabilities (Security Update 2009-006)	Nessus	MacOS X Local Security Checks	11/9/2009	5/28/2024	critical
43826	VMSA-2010-0001 : ESX Service Console and vMA updates for nss and nspr	Nessus	VMware ESX Local Security Checks	1/8/2010	1/6/2021	critical
89735	VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2010-0001) (remote check)	Nessus	VMware ESX Local Security Checks	3/8/2016	1/6/2021	critical
5152	SeaMonkey < 1.1.18 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/3/2009	3/6/2019	medium
5353	Mozilla Thunderbird < 2.0.0.23 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	3/4/2010	3/6/2019	medium
5113	Mozilla Firefox < 3.0.13/3.5.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/3/2009	3/6/2019	medium
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	11/10/2009	3/6/2019	critical

Detections

Analytics

Plugins Search

high

high

critical

high

high

critical

critical

critical

medium

medium

medium

critical