NVD

Id
30121  
Name
CVE-2014-1492  
Description
The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name"s U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-03-25  
Modified Date
2017-01-06  
Seq
2014-1492  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
158697 30121 CVE-2014-1492 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761  View
158698 30121 CVE-2014-1492 FEDORA-2014-5829  View
158699 30121 CVE-2014-1492 SUSE-SU-2014:0665  View
158700 30121 CVE-2014-1492 SUSE-SU-2014:0727  View
158701 30121 CVE-2014-1492 openSUSE-SU-2014:0599  View
158702 30121 CVE-2014-1492 openSUSE-SU-2014:0629  View
158703 30121 CVE-2014-1492 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
158704 30121 CVE-2014-1492 60621  View
158705 30121 CVE-2014-1492 60794  View
158706 30121 CVE-2014-1492 DSA-2994  View
158707 30121 CVE-2014-1492 http://www.mozilla.org/security/announce/2014/mfsa2014-45.html  View
158708 30121 CVE-2014-1492 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html  View
158709 30121 CVE-2014-1492 http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html  View
158710 30121 CVE-2014-1492 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
158711 30121 CVE-2014-1492 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
158712 30121 CVE-2014-1492 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
158713 30121 CVE-2014-1492 66356  View
158714 30121 CVE-2014-1492 USN-2159-1  View
158715 30121 CVE-2014-1492 USN-2185-1  View
158716 30121 CVE-2014-1492 http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
158717 30121 CVE-2014-1492 https://bugzilla.mozilla.org/show_bug.cgi?id=903885  View
158718 30121 CVE-2014-1492 https://bugzilla.redhat.com/show_bug.cgi?id=1079851  View
158719 30121 CVE-2014-1492 https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes  View
158720 30121 CVE-2014-1492 https://hg.mozilla.org/projects/nss/rev/709d4e597979  View
158721 30121 CVE-2014-1492 GLSA-201504-01  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12924 JVNDB-2014-001799 Mozilla Network Security Services の certificate-checking の実装における SSL サーバになりすまされる脆弱性 Mozilla Network Security Services (NSS) の certificate-checking の実装の lib/certdb/certdb.c 内の cert_TestHostName 関数は、国際化ドメイン名の U-label に埋め込まれているワイルドカード文字を受け入れるため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2014-1492 68779 CVE-2014-1492 30121 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001799.html 2014-03-05 2016-01-29 View