Debian Security Advisory
DSA-2123-1 nss -- several vulnerabilities
- Date Reported:
- 01 Nov 2010
- Affected Packages:
- nss
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2010-3170, CVE-2010-3173.
- More information:
-
Several vulnerabilities have been discovered in Mozilla's Network Security Services (NSS) library. The Common Vulnerabilities and Exposures project identifies the following problems:
- CVE-2010-3170
NSS recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- CVE-2010-3173
NSS does not properly set the minimum key length for Diffie-Hellman Ephemeral (DHE) mode, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
For the stable distribution (lenny), these problems have been fixed in version 3.12.3.1-0lenny2.
For the unstable distribution (sid) and the upcoming stable distribution (squeeze), these problems have been fixed in version 3.12.8-1.
We recommend that you upgrade your NSS packages.
- CVE-2010-3170
- Fixed in:
-
Debian GNU/Linux 5.0 (lenny)
- Source:
- http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.dsc
- http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.diff.gz
- http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1.orig.tar.gz
- http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.diff.gz
- Alpha:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_alpha.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_alpha.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_alpha.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_alpha.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_amd64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_amd64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_amd64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_amd64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_arm.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_arm.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_arm.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_arm.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_arm.deb
- ARM EABI:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_armel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_armel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_armel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_armel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_armel.deb
- HP Precision:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_hppa.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_hppa.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_hppa.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_hppa.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_hppa.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_i386.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_i386.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_i386.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_i386.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_ia64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_ia64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_ia64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_ia64.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_ia64.deb
- Big-endian MIPS:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_mips.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mips.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_mips.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mips.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mips.deb
- Little-endian MIPS:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_mipsel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mipsel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_mipsel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mipsel.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_powerpc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_powerpc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_powerpc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_powerpc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_s390.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_s390.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_s390.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_s390.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_sparc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_sparc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_sparc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_sparc.deb
- http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_sparc.deb
MD5 checksums of the listed files are available in the original advisory.