ID

VAR-201601-0016

CVE

CVE-2015-7575

TITLE

Mozilla Firefox Used in Mozilla Network Security Services Vulnerable to server impersonation

DESCRIPTION

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision. Supplementary information : CWE Vulnerability type by CWE-19: Data Handling ( Data processing ) Has been identified. http://cwe.mitre.org/data/definitions/19.htmlMan-in-the-middle attacks (man-in-the-middle attack) Could cause a server to be impersonated by inducing a collision. Mozilla Network Security Services is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. This issue is fixed in: Firefox 43.0.2 Firefox ESR 38.5.2 Network Security Services 3.20.2. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201801-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PolarSSL: Multiple vulnerabilities Date: January 15, 2018 Bugs: #537108, #620504 ID: 201801-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in PolarSSL, the worst of which may allow remote attackers to execute arbitrary code. Background ========== PolarSSL is a cryptographic library for embedded systems. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/polarssl < 1.3.9-r1 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker might be able to execute arbitrary code, cause Denial of Service condition or obtain sensitive information. Workaround ========== There is no known workaround at this time. Resolution ========== Gentoo has discontinued support for PolarSSL and recommends that users unmerge the package: # emerge --unmerge "net-libs/polarssl" References ========== [ 1 ] CVE-2015-1182 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1182 [ 2 ] CVE-2015-7575 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7575 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201801-15 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 --Ph5IIMEQMv2VnlKUQ7M7LCqtbxvbmuakb-- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.7.0-openjdk security update Advisory ID: RHSA-2016:0054-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0054.html Issue date: 2016-01-21 CVE Names: CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 ===================================================================== 1. Summary: Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, x86_64 Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64 3. Description: The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. (CVE-2016-0483) An integer signedness issue was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2016-0494) It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory. (CVE-2016-0466) A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client. (CVE-2015-7575) Multiple flaws were discovered in the Libraries, Networking, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-4871, CVE-2016-0402, CVE-2016-0448) Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file. All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1273859 - CVE-2015-4871 OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries) 1289841 - CVE-2015-7575 TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) 1298906 - CVE-2016-0494 ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) 1298957 - CVE-2016-0402 OpenJDK: URL deserialization inconsistencies (Networking, 8059054) 1299073 - CVE-2016-0448 OpenJDK: logging of RMI connection secrets (JMX, 8130710) 1299385 - CVE-2016-0466 OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) 1299441 - CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: java-1.7.0-openjdk-1.7.0.95-2.6.4.1.el5_11.src.rpm i386: java-1.7.0-openjdk-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.1.el5_11.i386.rpm x86_64: java-1.7.0-openjdk-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: java-1.7.0-openjdk-1.7.0.95-2.6.4.1.el5_11.src.rpm i386: java-1.7.0-openjdk-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.1.el5_11.i386.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.1.el5_11.i386.rpm x86_64: java-1.7.0-openjdk-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.1.el5_11.x86_64.rpm Red Hat Enterprise Linux Client (v. 7): Source: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.src.rpm x86_64: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.0.el7_2.noarch.rpm x86_64: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.src.rpm x86_64: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): noarch: java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.0.el7_2.noarch.rpm x86_64: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.src.rpm ppc64: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm ppc64le: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm s390x: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.s390x.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.s390x.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.s390x.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.s390x.rpm x86_64: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): noarch: java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.0.el7_2.noarch.rpm ppc64: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.ppc64.rpm ppc64le: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.ppc64le.rpm s390x: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.s390x.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.s390x.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.s390x.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.s390x.rpm x86_64: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.src.rpm x86_64: java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-devel-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-headless-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: java-1.7.0-openjdk-javadoc-1.7.0.95-2.6.4.0.el7_2.noarch.rpm x86_64: java-1.7.0-openjdk-accessibility-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-debuginfo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-demo-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm java-1.7.0-openjdk-src-1.7.0.95-2.6.4.0.el7_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-7575 https://access.redhat.com/security/cve/CVE-2016-0402 https://access.redhat.com/security/cve/CVE-2016-0448 https://access.redhat.com/security/cve/CVE-2016-0466 https://access.redhat.com/security/cve/CVE-2016-0483 https://access.redhat.com/security/cve/CVE-2016-0494 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWoNFZXlSAg2UNWIIRAvYtAJ0T259y/RFbWrejNoK4UPxBEoVexgCfY07r i1eQSFhVcK4IxLO6UxI3mTM= =0f/T -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6) - i386, x86_64 3. ============================================================================ Ubuntu Security Notice USN-2864-1 January 07, 2016 nss vulnerability ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: NSS could be made to expose sensitive information over the network. Software Description: - nss: Network Security Service library Details: Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: libnss3 2:3.19.2.1-0ubuntu0.15.10.2 Ubuntu 15.04: libnss3 2:3.19.2.1-0ubuntu0.15.04.2 Ubuntu 14.04 LTS: libnss3 2:3.19.2.1-0ubuntu0.14.04.2 Ubuntu 12.04 LTS: libnss3 3.19.2.1-0ubuntu0.12.04.2 After a standard system update you need to restart any applications that use NSS, such as Evolution and Chromium, to make all the necessary changes. 7) - x86_64 3. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. Background ========== mbed TLS (previously PolarSSL) is an "easy to understand, use, integrate and expand" implementation of the TLS and SSL protocols and the respective cryptographic algorithms and support code required. http://creativecommons.org/licenses/by-sa/2.5 --meXqunA8BhEhIM1DNPs3RlHKbtgWVCnXm-- . (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4871, CVE-2015-4872, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903, CVE-2015-5006, CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449) Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the CVE-2015-4806 issue. For the oldstable distribution (wheezy), these problems have been fixed in version 7u95-2.6.4-1~deb7u1. For the stable distribution (jessie), these problems have been fixed in version 7u95-2.6.4-1~deb8u1. For the unstable distribution (sid), these problems have been fixed in version 7u95-2.6.4-1

AFFECTED PRODUCTS