CVE-2014-1491

Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://hg.mozilla.org/projects/nss/rev/12c42006aed8	Patch Vendor Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/23	Not Applicable
http://secunia.com/advisories/56858	Third Party Advisory
http://secunia.com/advisories/56888	Third Party Advisory
http://secunia.com/advisories/56922	Third Party Advisory
http://www.debian.org/security/2014/dsa-2858	Third Party Advisory
http://www.debian.org/security/2014/dsa-2994	Third Party Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-12.html	Third Party Advisory Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Third Party Advisory
http://www.securityfocus.com/archive/1/534161/100/0/threaded	Not Applicable
http://www.securityfocus.com/bid/65332	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029717	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029720	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029721	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2102-1	Third Party Advisory
http://www.ubuntu.com/usn/USN-2102-2	Third Party Advisory
http://www.ubuntu.com/usn/USN-2119-1	Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2014-0012.html	Not Applicable
https://bugzilla.mozilla.org/show_bug.cgi?id=934545	Exploit Issue Tracking Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90886	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201504-01	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox_esr::::::::
	cpe:2.3:a:mozilla:network_security_services::::::::
	cpe:2.3:a:mozilla:seamonkey::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:oracle:enterprise_manager_ops_center::::::::
	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:::::::*
	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:::::::*
	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:::::::*
	cpe:2.3:a:oracle:vm_server:3.2::::::x86:

Configuration 3 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:19:::::::*
	cpe:2.3:o:fedoraproject:fedora:20:::::::*

Configuration 4 (hide)

OR	cpe:2.3:o:opensuse:opensuse:11.4:::::::*
	cpe:2.3:o:opensuse:opensuse:12.3:::::::*
	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
	cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3::::::
	cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::::
	cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::vmware::*
	cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3::::::

Configuration 5 (hide)

OR	cpe:2.3:o:debian:debian_linux:7.0:::::::*
	cpe:2.3:o:debian:debian_linux:8.0:::::::*

Configuration 6 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*

History

No history.

Information

Published : 2014-02-06 05:44

Updated : 2020-07-31 20:33

NVD link : CVE-2014-1491

Mitre link : CVE-2014-1491

CVE.ORG link : CVE-2014-1491

JSON object : View

Products Affected

suse

linux_enterprise_desktop
linux_enterprise_server
linux_enterprise_software_development_kit

oracle

enterprise_manager_ops_center
vm_server

canonical

ubuntu_linux

mozilla

firefox
firefox_esr
thunderbird
seamonkey
network_security_services

fedoraproject

fedora

opensuse

opensuse

debian

debian_linux

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2014-1491", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-02-06T05:44:25.127", "references": [{"url": "http://hg.mozilla.org/projects/nss/rev/12c42006aed8", "tags": ["Patch", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://seclists.org/fulldisclosure/2014/Dec/23", "tags": ["Not Applicable"], "source": "security@mozilla.org"}, {"url": "http://secunia.com/advisories/56858", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://secunia.com/advisories/56888", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://secunia.com/advisories/56922", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.debian.org/security/2014/dsa-2858", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.debian.org/security/2014/dsa-2994", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.mozilla.org/security/announce/2014/mfsa2014-12.html", "tags": ["Third Party Advisory", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded", "tags": ["Not Applicable"], "source": "security@mozilla.org"}, {"url": "http://www.securityfocus.com/bid/65332", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1029717", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1029720", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1029721", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "http://www.ubuntu.com/usn/USN-2102-1", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.ubuntu.com/usn/USN-2102-2", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.ubuntu.com/usn/USN-2119-1", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html", "tags": ["Not Applicable"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=934545", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90886", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "https://security.gentoo.org/glsa/201504-01", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value."}, {"lang": "es", "value": "Mozilla Network Security Services (NSS) anterior a 3.15.4, utilizado en Mozilla Firefox anterior a 27.0, Firefox ESR 24.x anterior a 24.3, Thunderbird anterior a 24.3, SeaMonkey anterior a 2.24 y otros productos, no restringe debidamente los valores p\u00fablicos en el intercambio de claves de Diffie-Hellman, lo que facilita a atacantes remotos evadir mecanismos de protecci\u00f3n criptogr\u00e1fica en el manejo de tickets mediante el aprovechamiento de un cierto valor."}], "lastModified": "2020-07-31T20:33:55.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86B3B84A-9D1F-4863-987C-5C958B05C523", "versionEndExcluding": "27.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61098C94-A0E8-4993-8368-9E9900BAB49D", "versionEndExcluding": "24.3"}, {"criteria": "cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACA8EEC7-FACD-41E8-AF9F-F8DB0D477D8C", "versionEndExcluding": "3.15.4"}, {"criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "328319A6-42EE-408E-91A8-87156C17AE46", "versionEndExcluding": "2.24"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4295262-F0E0-4E6B-A01C-C7BF51CB011E", "versionEndExcluding": "24.3.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A70BB445-EF2B-4C9D-8502-FDD6A19F8C30", "versionEndExcluding": "12.1.4"}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4725EA61-9BAB-4E72-9F92-ADE4624439CC"}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0879FB1-58E2-4EC4-8111-044642E046BD"}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7CF2929-4CBC-4B56-87AE-F45F53BD8DD6"}, {"criteria": "cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "FC9E8528-0FB8-4BF0-A9EF-6CC84A2631A1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5991814D-CA77-4C25-90D2-DB542B17E0AD"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE554781-1EB9-446E-911F-6C11970C47F4"}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668"}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3ED68ADD-BBDA-4485-BC76-58F011D72311"}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B072472-B463-4647-885D-E40B0115C810"}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*", "vulnerable": true, "matchCriteriaId": "2470C6E8-2024-4CF5-9982-CFF50E88EAE9"}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F7F8866-DEAD-44D1-AB10-21EE611AA026"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "8D305F7A-D159-4716-AB26-5E38BB5CD991"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}

4.3 /10