Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 454
Alerts This Week
Warning Icon 1 454

Debian: DSA-3336-1 Moderate: nss Man-In-The-Middle Attack Threat

debian
Calendar Grey August 17, 2015
Debian Logo
Multiple vulnerabilities identified in nss; Debian users advised to upgrade. Guidance on addressing these security flaws can be found.
Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library
Topics%20covered

Topics Covered

security advisory Debian man-in-the-middle nss TLS flaw ECC signature

Summary

CVE-2015-2721

Karthikeyan Bhargavan discovered that NSS incorrectly handles state
transitions for the TLS state machine. A man-in-the-middle attacker
could exploit this flaw to skip the ServerKeyExchange message and
remove the forward-secrecy property.

CVE-2015-2730

Watson Ladd discovered that NSS does not properly perform Elliptical
Curve Cryptography (ECC) multiplication, allowing a remote attacker
to potentially spoof ECDSA signatures.

For the oldstable distribution (wheezy), these problems have been fixed
in version 2:3.14.5-1+deb7u5.

For the stable distribution (jessie), these problems have been fixed in
version 2:3.17.2-1.1+deb8u1.

For the testing distribution (stretch), these problems have been fixed
in version 2:3.19.1-1.

For the unstable distribution (sid), these problems have been fixed in
version 2:3.19.1-1.

We recommend that you upgrade your nss packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequent...

Read the Full Advisory

Severity
important
Lowest
Low
Medium
High
Critical

Package: nss
CVE ID: CVE-2015-2721 CVE-2015-2730

Topics%20covered

Topics Covered

security advisory Debian man-in-the-middle nss TLS flaw ECC signature

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.