CVE-2011-4973: Critical severity red hat mod nss vulnerability
A flaw was reported in the way modnss handled FakeBasicAuth NSSOption. Unlike modssl, modnss only used CommonName from a client certificate's subject, rather than the whole subject DN. This made safety check inherited from modssl that ensured client can not submit username and password generated by FakeBasicAuth via Authorization header without actually providing valid client certificate. Further details are in the Jared Jennings' post to the modnss mailing list:
https://www.redhat.com/archives/modnss-list/2011-May/msg00001.html
Problem was corrected in the following upstream git commit:
https://git.fedorahosted.org/cgit/modnss.git/commit/?id=a6c3370491ae1d3bc552e8de9353c82f73e510e3
This fix is not yet included in any released modnss version. The last released version to date is 1.0.8 from Jul 2008.
This problem was already corrected in Red Hat Enterprise Linux 5 and 6 modnss packages via the following errata:
https://rhn.redhat.com/errata/RHBA-2011-1656.html https://rhn.redhat.com/errata/RHBA-2013-0009.html
Other sources
Authentication bypass vulnerability in modnss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'password' as the password.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4973?
CVE-2011-4973 has been rated as a medium severity vulnerability due to the potential risk of improper authentication.
How do I fix CVE-2011-4973?
To fix CVE-2011-4973, update mod_nss to version 1.0.9 or later, which addresses the handling of the client certificate's subject.
Which versions of mod_nss are affected by CVE-2011-4973?
CVE-2011-4973 affects mod_nss version 1.0.8.
What vulnerability does CVE-2011-4973 address in mod_nss?
CVE-2011-4973 addresses a flaw in mod_nss related to the incorrect handling of client certificate common names during authentication.
Is mod_ssl also affected by CVE-2011-4973?
No, CVE-2011-4973 specifically affects mod_nss and not mod_ssl.