RHSA-2009:1186: Critical: nspr and nss security, bug fix, and enhancement update

First published: Thu Jul 30 2009(Updated: )

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI<br>operating system facilities. These facilities include threads, thread<br>synchronization, normal file and network I/O, interval timing, calendar<br>time, basic memory management (malloc and free), and shared library linking.<br>Network Security Services (NSS) is a set of libraries designed to support<br>the cross-platform development of security-enabled client and server<br>applications. Applications built with NSS can support SSLv2, SSLv3, TLS,<br>and other security standards.<br>These updated packages upgrade NSS from the previous version, 3.12.2, to a<br>prerelease of version 3.12.4. The version of NSPR has also been upgraded<br>from 4.7.3 to 4.7.4. <br>Moxie Marlinspike reported a heap overflow flaw in a regular expression<br>parser in the NSS library used by browsers such as Mozilla Firefox to match<br>common names in certificates. A malicious website could present a<br>carefully-crafted certificate in such a way as to trigger the heap<br>overflow, leading to a crash or, possibly, arbitrary code execution with<br>the permissions of the user running the browser. (CVE-2009-2404)<br>Note: in order to exploit this issue without further user interaction in<br>Firefox, the carefully-crafted certificate would need to be signed by a<br>Certificate Authority trusted by Firefox, otherwise Firefox presents the<br>victim with a warning that the certificate is untrusted. Only if the user<br>then accepts the certificate will the overflow take place.<br>Dan Kaminsky discovered flaws in the way browsers such as Firefox handle<br>NULL characters in a certificate. If an attacker is able to get a<br>carefully-crafted certificate signed by a Certificate Authority trusted by<br>Firefox, the attacker could use the certificate during a man-in-the-middle<br>attack and potentially confuse Firefox into accepting it by mistake.<br>(CVE-2009-2408)<br>Dan Kaminsky found that browsers still accept certificates with MD2 hash<br>signatures, even though MD2 is no longer considered a cryptographically<br>strong algorithm. This could make it easier for an attacker to create a<br>malicious certificate that would be treated as trusted by a browser. NSS<br>now disables the use of MD2 and MD4 algorithms inside signatures by<br>default. (CVE-2009-2409)<br>All users of nspr and nss are advised to upgrade to these updated packages,<br>which resolve these issues and add an enhancement.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/references
• agent/type
• agent/first-publish-date
• agent/softwarecombine
• agent/last-modified-date
• agent/remedy
• agent/title
• agent/tags
• agent/description
• agent/event
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:1186
• agent/software-canonical-lookup
• package-manager/redhat