CVE-2014-1569

Mandriva Linux Security Advisory 2014-252

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.

La función definite_length_decoder en lib/util/quickder.c en Mozilla Network Security Services (NSS) anterior a 3.16.2.4 y 3.17.x anterior a 3.17.3 no asegura que la codfifcación DER de una longitud ASN.1 está formada correctamente, lo que permite a atacantes remotos realizar ataques del trafico de datos mediante el uso de una secuencia de bytes larga para una codificación, tal y como fue demostrado por el mal manejo de la función SEC_QuickDERDecodeItem de la codificación de longitud arbitraria de 0x00.

In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data. This update adds support for the TLS Fallback Signaling Cipher Suite Value in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-01-16 CVE Reserved
2014-12-15 CVE Published
2024-08-06 CVE Updated
2024-08-06 First Exploit
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (15)

URL	Tag	Source
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	X_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	X_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html	X_refsource_confirm
http://www.securitytracker.com/id/1032909	Vdb Entry

URL	Date	SRC
http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf	2024-08-06
https://bugzilla.mozilla.org/show_bug.cgi?id=1064670	2024-08-06
https://www.imperialviolet.org/2014/09/26/pkcs1.html	2024-08-06
https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02	2024-08-06

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html	2017-09-22
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html	2017-09-22
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html	2017-09-22
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html	2017-09-22
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html	2017-09-22
http://www.debian.org/security/2015/dsa-3186	2017-09-22
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes	2017-09-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				<= 3.16.2.3 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.16.2.3"		-		Affected
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				3.16.2.0 Search vendor "Mozilla" for product "Network Security Services" and version "3.16.2.0"		-		Affected
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				3.16.2.1 Search vendor "Mozilla" for product "Network Security Services" and version "3.16.2.1"		-		Affected
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				3.16.2.2 Search vendor "Mozilla" for product "Network Security Services" and version "3.16.2.2"		-		Affected
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				3.17.0 Search vendor "Mozilla" for product "Network Security Services" and version "3.17.0"		-		Affected
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				3.17.1 Search vendor "Mozilla" for product "Network Security Services" and version "3.17.1"		-		Affected
Mozilla Search vendor "Mozilla"		Network Security Services Search vendor "Mozilla" for product "Network Security Services"				3.17.2 Search vendor "Mozilla" for product "Network Security Services" and version "3.17.2"		-		Affected