Debian Security Advisory DSA 3033-1 (nss - Security Update) Network Vulnerability

Summary

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library) was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA certificates with a valid certification chain to a trusted CA.

Solution

For the stable distribution (wheezy), this problem has been fixed in version 2:3.14.5-1+deb7u2. For the testing distribution (jessie), this problem has been fixed in version 2:3.17.1. For the unstable distribution (sid), this problem has been fixed in version 2:3.17.1. We recommend that you upgrade your nss packages.

Insight

nss is a set of libraries designed to support cross-platform development of security-enabled client and server applications.

Affected

nss on Debian Linux

Detection

This check tests the installed software version using the apt package manager.

References