CVE-2011-5094: Medium severity mozilla nss esr vulnerability

Published Jun 16, 2012

Updated

DISPUTED Mozilla Network Security Services (NSS) 3.x, with certain settings of the SSLENABLERENEGOTIATION option, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-1473. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment.

Affected Software

23 affected components

Mozilla Network Security Services=3.2

Mozilla Network Security Services=3.2.1

Mozilla Network Security Services=3.3

Mozilla Network Security Services=3.3.1

Mozilla Network Security Services=3.3.2

Mozilla Network Security Services=3.4

Mozilla Network Security Services=3.4.1

Mozilla Network Security Services=3.4.2

Mozilla Network Security Services=3.5

Mozilla Network Security Services=3.6

Mozilla Network Security Services=3.6.1

Mozilla Network Security Services=3.7

Mozilla Network Security Services=3.7.1

Mozilla Network Security Services=3.7.2

Mozilla Network Security Services=3.7.3

Mozilla Network Security Services=3.7.5

Mozilla Network Security Services=3.7.7

Mozilla Network Security Services=3.8

Mozilla Network Security Services=3.9

Mozilla Network Security Services=3.11.2

Mozilla Network Security Services=3.11.3

Mozilla Network Security Services=3.11.4

Mozilla Network Security Services=3.11.5

Event History

Jun 16, 2012

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Disputed

09:55 PM

Frequently Asked Questions

What is the severity of CVE-2011-5094?

The severity of CVE-2011-5094 is classified as medium due to the potential for denial of service attacks.

How do I fix CVE-2011-5094?

To fix CVE-2011-5094, update to a version of Mozilla NSS that is not affected, specifically version 3.12.0 or later.

Which versions of Mozilla NSS are vulnerable to CVE-2011-5094?

Versions Mozilla NSS 3.2 through 3.11.5 are vulnerable to CVE-2011-5094.

What type of attack can CVE-2011-5094 facilitate?

CVE-2011-5094 can facilitate denial of service attacks that exhaust CPU resources.

Is CVE-2011-5094 related to SSL/TLS protocols?

Yes, CVE-2011-5094 is related to vulnerabilities in SSL and TLS protocols due to issues with client-initiated renegotiation.