CVE-2013-4566: Medium severity red hat mod nss vulnerability
A flaw was found in the way NSSVerifyClient was handled when used in both server / vhost context as well as directory context (specified either via <Directory> or <Location> directive). If 'NSSVerifyClient none' was set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication was expected to be required for a specific directory via 'NSSVerifyClient require' setting, modnss failed to properly require expected certificate authentication. Remote attacker able to connect to the web server using such modnss configuration and without a valid client certificate could possibly use this flaw to access content of the restricted directories.
Documentation of modnss configuration directives, including NSSVerifyClient:
https://git.fedorahosted.org/cgit/modnss.git/plain/docs/modnss.html#Directives
As modnss is derived form modssl, NSSVerifyClient is meant to be functionally equivalent to modssl's SSLVerifyClient:
http://httpd.apache.org/docs/2.2/mod/modssl.html#sslverifyclient
Other sources
modnss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4566?
CVE-2013-4566 has a medium severity level due to its impact on client authentication.
How do I fix CVE-2013-4566?
To fix CVE-2013-4566, ensure that you do not set 'NSSVerifyClient none' in the server context and update to a patched version of mod_nss.
What versions are affected by CVE-2013-4566?
CVE-2013-4566 affects mod_nss versions up to 1.0.8 and specific versions like 1.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, and 1.0.7.
Is CVE-2013-4566 exploitable remotely?
Yes, CVE-2013-4566 is exploitable remotely, potentially allowing unauthorized access if not mitigated.
Who is impacted by CVE-2013-4566?
Organizations using affected versions of mod_nss in their server configurations are impacted by CVE-2013-4566.