CVE

Id
68864  
CVE No.
CVE-2014-1569  
Status
Candidate  
Description
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function"s improper handling of an arbitrary-length encoding of 0x00.  
Phase
Assigned (20140116)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
662352 68864 CVE-2014-1569 MISC:http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf  View
662353 68864 CVE-2014-1569 MISC:https://www.imperialviolet.org/2014/09/26/pkcs1.html  View
662354 68864 CVE-2014-1569 MISC:https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02  View
662355 68864 CVE-2014-1569 CONFIRM:https://bugzilla.mozilla.org/show_bug.cgi?id=1064670  View
662356 68864 CVE-2014-1569 CONFIRM:https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes  View
662357 68864 CVE-2014-1569 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html  View
662358 68864 CVE-2014-1569 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html  View
662359 68864 CVE-2014-1569 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
662360 68864 CVE-2014-1569 DEBIAN:DSA-3186  View
662361 68864 CVE-2014-1569 URL:http://www.debian.org/security/2015/dsa-3186  View
662362 68864 CVE-2014-1569 SUSE:SUSE-SU-2015:0171  View
662363 68864 CVE-2014-1569 URL:http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html  View
662364 68864 CVE-2014-1569 SUSE:SUSE-SU-2015:0173  View
662365 68864 CVE-2014-1569 URL:http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html  View
662366 68864 CVE-2014-1569 SUSE:SUSE-SU-2015:0180  View
662367 68864 CVE-2014-1569 URL:http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html  View
662368 68864 CVE-2014-1569 SUSE:openSUSE-SU-2015:0138  View
662369 68864 CVE-2014-1569 URL:http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html  View
662370 68864 CVE-2014-1569 SUSE:openSUSE-SU-2015:0404  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16015 JVNDB-2014-004890 Mozilla Firefox および Thunderbird の Web Audio サブシステムにおけるプロセスメモリから重要な情報を取得される脆弱性 Mozilla Firefox および Thunderbird の Web Audio サブシステムの mozilla::dom::OscillatorNodeEngine::ComputeCustom 関数には、プロセスメモリから重要な情報を取得される、またはサービス運用妨害 (out-of-bounds read、メモリ破損、およびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-1577 68864 6.4 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004890.html  View