CVE-2014-1569
First published: Mon Dec 15 2014(Updated: )
Mozilla Network Security Services (NSS) could allow a remote attacker to bypass security restrictions, caused by the failure to ensure that the DER encoding of an ASN.1 length is properly formed by the definite_length_decoder function. An attacker could exploit this vulnerability using a long byte sequence for an encoding to bypass restrictions and conduct data-smuggling attacks.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Network Security Services | <=3.16.2.3 | |
| Mozilla Network Security Services | =3.16.2.0 | |
| Mozilla Network Security Services | =3.16.2.1 | |
| Mozilla Network Security Services | =3.16.2.2 | |
| Mozilla Network Security Services | =3.17.0 | |
| Mozilla Network Security Services | =3.17.1 | |
| Mozilla Network Security Services | =3.17.2 | |
| IBM Cognos Analytics | <=12.0.0-12.0.3 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html
- http://www.debian.org/security/2015/dsa-3186
- http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- http://www.securitytracker.com/id/1032909
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064670
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes
- https://www.imperialviolet.org/2014/09/26/pkcs1.html
- https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02
- https://www.ibm.com/support/pages/node/7177223 (Advisory)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/mozilla
- canonical/mozilla network security services
- version/mozilla network security services/3.16.2.3
- version/mozilla network security services/3.16.2.0
- version/mozilla network security services/3.16.2.1
- version/mozilla network security services/3.16.2.2
- version/mozilla network security services/3.17.0
- version/mozilla network security services/3.17.1
- version/mozilla network security services/3.17.2
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.3
- version/ibm cognos analytics/11.2.0-11.2.4 fp4