Red Hat Bugzilla – Bug 1116198
CVE-2014-1544 nss: Race-condition in certificate verification can lead to Remote code execution (MFSA 2014-63)
Last modified: 2014-09-08 10:15:40 EDT
A race-condition during certication verification could lead to remote code execution. Mozilla describes this flaw as: Security researchers Tyson Smith and Jesse Schwartzentruber used the Address Sanitizer tool while fuzzing to discover a use-after-free error resulting in a crash. This is a result of a pair of NSSCertificate structures being added to a trust domain and then one of them is removed while they are still in use by the trusted cache. This crash is potentially exploitable. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. https://bugzilla.mozilla.org/show_bug.cgi?id=963150 (private) Patch: https://hg.mozilla.org/projects/nss/rev/204f22c527f8 External Reference: http://www.mozilla.org/security/announce/2014/mfsa2014-63.html Acknowledgements: Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters.
This issue has been addressed in following products: Red Hat Enterprise Linux 5.6 Long Life Red Hat Enterprise Linux 5.9 EUS - Server Only Red Hat Enterprise Linux 6.2 AUS Red Hat Enterprise Linux 6.4 EUS - Server and Compute Node Only Via RHSA-2014:0915 https://rhn.redhat.com/errata/RHSA-2014-0915.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0917 https://rhn.redhat.com/errata/RHSA-2014-0917.html
This issue has been addressed in following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 Via RHSA-2014:0916 https://rhn.redhat.com/errata/RHSA-2014-0916.html
This issue has been addressed upstream in nss 3.16.2. Fedora 19 and Fedora 20 already ships nss-3.16.2 via the following advisories: https://admin.fedoraproject.org/updates/FEDORA-2014-8047/nss-3.16.2-1.fc19,nss-softokn-3.16.2-1.fc19,nss-util-3.16.2-1.fc19 https://admin.fedoraproject.org/updates/FEDORA-2014-7941/nss-util-3.16.2-1.fc20,nss-softokn-3.16.2-1.fc20,nss-3.16.2-1.fc20
IssueDescription: A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application.
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Extended Lifecycle Support Via RHSA-2014:1165 https://rhn.redhat.com/errata/RHSA-2014-1165.html