CVE-2014-1492: Input Validation

Q: What is the severity of CVE-2014-1492?

CVE-2014-1492 has been rated as a moderate severity vulnerability due to improper validation of wildcard certificates.

Q: How do I fix CVE-2014-1492?

To fix CVE-2014-1492, update the affected NSS package to version 3.16 or later.

Q: Which software versions are vulnerable to CVE-2014-1492?

Vulnerable software versions include NSS versions up to 3.15.5 and specific ranges of 3.2 to 3.9.

Q: What impact does CVE-2014-1492 have on secure communications?

CVE-2014-1492 could allow attackers to exploit wildcard certificates inadequately validated, potentially compromising secure communications.

Q: Is there a workaround for CVE-2014-1492 while I update?

A temporary workaround is to avoid the use of wildcard certificates in internationalized domain names until the update is applied.

Published Mar 24, 2014

Updated

In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. This was not properly implemented in NSS, as a result it did not handle IDNA domain prefixes according to RFC 6125, section 6.4.3 "Checking of Wildcard Certificates". http://tools.ietf.org/html/rfc6125#section-6.4.3

Upstream patch: https://hg.mozilla.org/projects/nss/rev/15ea62260c21 https://hg.mozilla.org/projects/nss/rev/2ffa40a3ff55 https://hg.mozilla.org/projects/nss/rev/709d4e597979

Upstream bug (not public): https://bugzilla.mozilla.org/showbug.cgi?id=903885

This issue was fixed upstream in NSS 3.16: https://developer.mozilla.org/en-US/docs/NSS/NSS3.16releasenotes

Other sources

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

— MITRE

Affected Software

51 affected componentsFixes available

redhat/nss<3.16

3.16

Mozilla Network Security Services<=3.15.5

Mozilla Network Security Services=3.2

Mozilla Network Security Services=3.2.1

Mozilla Network Security Services=3.3

Mozilla Network Security Services=3.3.1

Mozilla Network Security Services=3.3.2

Mozilla Network Security Services=3.4

Mozilla Network Security Services=3.4.1

Mozilla Network Security Services=3.4.2

Mozilla Network Security Services=3.5

Mozilla Network Security Services=3.6

Mozilla Network Security Services=3.6.1

Mozilla Network Security Services=3.7

Mozilla Network Security Services=3.7.1

Mozilla Network Security Services=3.7.2

Mozilla Network Security Services=3.7.3

Mozilla Network Security Services=3.7.5

Mozilla Network Security Services=3.7.7

Mozilla Network Security Services=3.8

Mozilla Network Security Services=3.9

Mozilla Network Security Services=3.11.2

Mozilla Network Security Services=3.11.3

Mozilla Network Security Services=3.11.4

Mozilla Network Security Services=3.11.5

Mozilla Network Security Services=3.12

Mozilla Network Security Services=3.12.1

Mozilla Network Security Services=3.12.2

Mozilla Network Security Services=3.12.3

Mozilla Network Security Services=3.12.3.1

Mozilla Network Security Services=3.12.3.2

Mozilla Network Security Services=3.12.4

Mozilla Network Security Services=3.12.5

Mozilla Network Security Services=3.12.6

Mozilla Network Security Services=3.12.7

Mozilla Network Security Services=3.12.8

Mozilla Network Security Services=3.12.9

Mozilla Network Security Services=3.12.10

Mozilla Network Security Services=3.12.11

Mozilla Network Security Services=3.14

Mozilla Network Security Services=3.14.1

Mozilla Network Security Services=3.14.2

Mozilla Network Security Services=3.14.3

Mozilla Network Security Services=3.14.4

Mozilla Network Security Services=3.14.5

Mozilla Network Security Services=3.15

Mozilla Network Security Services=3.15.1

Mozilla Network Security Services=3.15.2

Mozilla Network Security Services=3.15.3

Mozilla Network Security Services=3.15.3.1

Mozilla Network Security Services=3.15.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 3.16
Upgrade
Upgrade Mozilla Network Security Services (NSS) to a version that resolves this vulnerability.
Fixed in 3.16

Event History

Mar 25, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:25 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-1492?

CVE-2014-1492 has been rated as a moderate severity vulnerability due to improper validation of wildcard certificates.

How do I fix CVE-2014-1492?

To fix CVE-2014-1492, update the affected NSS package to version 3.16 or later.

Which software versions are vulnerable to CVE-2014-1492?