OSVDB ID: 32105

Title: Mozilla Multiple Products NSS SSLv2 Client Overflow

Info

Disclosure
Feb 23, 2007

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 A remote overflow exists in multiple versions of Mozilla Firefox, Mozilla Network Security Services (NSS), Mozilla SeaMonkey, and Mozilla Thunderbird. The vulnerability is due to an error in the Network Security Services (NSS) code that can occur when processing certain SSLv2 server messages. The products fail to properly process SSL server certificates which possess an RSA public key that is too small to encrypt the entire SSLv2 "Master Secret". This may result in a heap-based overflow and may allow an attacker execution of arbitrary code, resulting in a loss of integrity and/or availability.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Exploit: Exploit Public, Exploit Private
Disclosure: OSVDB Verified

Solution

 Upgrade to the following versions of the affected products as these versions have been reported to fix this vulnerability: Mozilla Network Security Services (NSS): version 3.11.5 or higher Mozilla Firefox: version 2.0.2 or higher Mozilla Thunderbird: version 1.5.0.10 or higher Mozilla SeaMonkey: version 1.0.8 or higher It is also possible to correct the flaw by implementing the following workaround(s): Disable the SSLv2 protocol in any product that has not already done so. In Mozilla Firefox 1.5: 1) Click on the Advanced icon in the Options/Preferences dialog. 2) On the Security tab uncheck the box next to "Use SSL 2.0" 3) Click the "OK" button. In Mozilla Thunderbird 1.5: 1) Click on the Advanced icon in the Options/Preferences dialog. 2) Click the "Config Editor..." button. 3) Type ssl2 in the Filter field 4) Double-click security.enable_ssl2 to change the value to false and close the window. Mozilla Network Security Services (NSS): Disable the SSLv2 protocol.

Products

Mozilla Organization

Firefox

 2.0.0.2
1.5.0.10
1.0
1.5
1.5 beta 1
1.5 beta 2
1.5.0.1
1.5.0.2
1.5.0.3
1.5.0.4
1.5.0.5
1.5.0.6
1.5.0.7
1.5.0.9
2.0
2.0 Beta 1
2.0 RC2
2.0 RC3
2.0.1
0.x
1.0.x

Thunderbird

 1.5.0.10
1.0.x
0.x
1.5 beta 2
1.5.9
1.5
1.5.0.7
1.5.0.5
1.5.0.4
1.5.0.2
1.5.0.1

SeaMonkey

 1.0.8
1.1.1
1.1 Alpha
1.1 Beta
1.0.x

Network Security Services (NSS)

 3.11.5
3.11.3
3.10
3.11.4
3.9.x
3.8.x
3.7.x
3.6.x
3.5.x
3.4.x
3.3.x
3.2.x

References

Credit
  • Michał Luczaj - regenrechto2.pl -


Direct URL: http://osvdb.org/36218