CERT-In Advisory
CIAD-2013-0085
Multiple Vulnerabilities in Mozilla Network Security Services Products
Original Issue Date: December 09, 2013
Severity Rating: High
Systems Affected
- Mozilla Firefox prior to 25.0.1
- Mozilla Firefox ESR prior to 24.1.1
- Mozilla Firefox ESR prior to 17.0.11
- Mozilla Thunderbird prior to 24.1.1
- Mozilla Thunderbird ESR prior to 17.0.11
- Mozilla SeaMonkey prior to 2.22.1
Component Affected
- Network Security Services (NSS) 3.14.x prior to 3.14.5
- Network Security Services (NSS) 3.15.x prior to 3.15.3
- Netscape Portable Runtime (NSPR) prior to 4.10.2
Overview
Multiple vulnerabilities have been reported in Mozilla Firefox, SeaMonkey and Thunderbird which could be exploited by a remote attacker to bypass certain security restrictions, disclose potentially sensitive information and causes denial of service condition
Description
1. Denial of Service Vulnerability
(
CVE-2013-5605
)
This vulnerability is caused due to an error related to Null cipher in Network Security Services (NSS) in Mozilla Firefox, SeaMonkey and Thunderbird. A remote attacker could exploit this vulnerability via invalid handshake packets to trigger buffer overflow error.
Successful exploitation of this vulnerability could allow a remote attacker to cause denial of service condition.
2. Certificate Validation Security Bypass Vulnerability
(
CVE-2013-5606
)
This vulnerability is caused due to an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid in CERT_VerifyCert function in lib/certhigh/certvfy.c in Network Security Services (NSS) in Mozilla Firefox, SeaMonkey and Thunderbird. A Remote attacker could exploit this vulnerability via a crafted certificate to bypass certain security restrictions.
Successful exploitation of this vulnerability could allow a remote attacker to bypass certain intended access restrictions.
3. Denial of Service Vulnerability in Netscape Portable Runtime (NSPR)
(
CVE-2013-5607
)
This vulnerability is caused due to an error in certificate parsing on 64-bit computers in PL_ArenaAllocate function in Netscape Portable Runtime (NSPR) in Mozilla Firefox, SeaMonkey. A remote attacker could exploit this vulnerability via a specially crafted certificate to trigger a certificate parsing error.
Successful exploitation of this vulnerability could allow a remote attacker to cause denial of service condition.
4. Integer Overflow Vulnerability
(
CVE-2013-1741
)
This vulnerability is caused due to an error Network Security Services (NSS) in Mozilla Firefox, SeaMonkey and Thunderbird. A remote attacker could exploit this vulnerability via a large size value to trigger integer overflow error.
Successful exploitation of this vulnerability could allow a remote attacker to cause denial of service condition.
Solution
Upgrade to Mozilla Firefox version 25.0.1
http://www.mozilla.org/en-US/firefox/new/
Upgrade to Mozilla Thunderbird version 24.1.1
http://www.mozilla.org/en-US/thunderbird/
Upgrade to Mozilla SeaMonkey version 2.22.1
http://www.mozilla.org/en-US/seamonkey/
Vendor Information
Mozilla
http://www.mozilla.org/security/announce/2013/mfsa2013-103.html
References
Secunia
http://secunia.com/community/advisories/55557
SecurityTracker
http://securitytracker.com/id/1029358
http://securitytracker.com/id/1029359
CVE Name
CVE-2013-5605
CVE-2013-5606
CVE-2013-5607
CVE-2013-1741
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|