Ubuntu 13.10 USN-2159-1: Critical NSS Information Exposure

ubuntu

April 2, 2014

NSS could be made to expose sensitive information over the network.

Summary

NSS could be made to expose sensitive information over the network.

Software Description:

- nss: Network Security Service library

Details:

It was discovered that NSS incorrectly handled wildcard certificates when

used with internationalized domain names. If a remote attacker were able to

perform a man-in-the-middle attack, this flaw could be exploited to spoof

SSL servers.

Topics Covered

security advisory network security critical Ubuntu information exposure man-in-the-middle NSS

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libnss3                         2:3.15.4-0ubuntu0.13.10.2

Ubuntu 12.10:
  libnss3                         3.15.4-0ubuntu0.12.10.2

Ubuntu 12.04 LTS:
  libnss3                         3.15.4-0ubuntu0.12.04.2

Ubuntu 10.04 LTS:
  libnss3-1d                      3.15.4-0ubuntu0.10.04.2

After a standard system update you need to restart any applications that
use NSS, such as Evolution and Chromium, to make all the necessary changes.