The remote Solaris system is missing necessary patches to address security updates.

A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544)

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740)

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application.
(CVE-2014-1490)

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491)

An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545)

It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid.
(CVE-2014-1492)

In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions.

After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

  - It may be possible to spoof drag and drop events in     web content. This may allow limited ability to interact     with the UI. (CVE-2014-1561)

A vulnerability has been found and corrected in mozilla NSS :

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

The updated packages have been upgraded to the latest NSS (3.16.3) versions which is not vulnerable to this issue.

The nss 3.16.1 update done as part of MDVSA-2014:125 introduced a regression because of the upstream change: 'Imposed name constraints on the French government root CA ANSSI (DCISS)' The change wont work as currently implemented as the French government root CA signs more than 'gouv.fr' domains. So for now we revert that change until its properly fixed upstream (mga#13563).

Additionally the rootcerts package has also been updated to the latest version as of 2014-07-03, which adds, removes, and distrusts several certificates.

Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages :

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate (CVE-2014-1492).

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a signature malleability issue (CVE-2014-1568).

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00 (CVE-2014-1569).

Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545).

The sqlite3 packages have been upgraded to the 3.8.6 version due to an prerequisite to nss-3.17.x.

Additionally the rootcerts package has also been updated to the latest version as of 2014-11-17, which adds, removes, and distrusts several certificates.

The updated packages provides a solution for these security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0917 advisory.

    nspr     [4.10.6-1]
    - Rebase to nspr-4.10.6
    - Resolves: rhbz#1112135

    nss     [3.16.1-4.0.1.el6_5]
    - Added nss-vendor.patch to change vendor

    [3.16.1-4]
    - Update some patches on account of the rebase
    - Resolves: Bug 1099619

    [3.16.1-3]
    - Backport nss-3.12.6 upstream fix required by Firefox 31
    - Resolves: Bug 1099619

    [3.16.1-2]
    - Remove two unused patches and apply a needed one that was missed
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    [3.16.1-1]
    - Update to nss-3.16.1
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    nss-util     [3.15.6-1]
    - Update to nss-3.16.1
    - Resolves: rhbz#1112136

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
80610	Oracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_fixed_in_firefox1)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	critical
76702	Scientific Linux Security Update : nss and nspr on SL6.x i386/x86_64 (20140722)	Nessus	Scientific Linux Local Security Checks	7/23/2014	1/14/2021	critical
76763	Firefox < 31.0 Multiple Vulnerabilities	Nessus	Windows	7/24/2014	6/23/2026	critical
76885	Mandriva Linux Security Advisory : nss (MDVSA-2014:139)	Nessus	Mandriva Local Security Checks	7/30/2014	1/6/2021	critical
81942	Mandriva Linux Security Advisory : nss (MDVSA-2015:059)	Nessus	Mandriva Local Security Checks	3/19/2015	1/6/2021	critical
76694	Oracle Linux 6 : nss / and / nspr (ELSA-2014-0917)	Nessus	Oracle Linux Local Security Checks	7/23/2014	10/23/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical