NVD

Id
30194  
Name
CVE-2014-1569  
Description
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function"s improper handling of an arbitrary-length encoding of 0x00.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-15  
Modified Date
2016-10-03  
Seq
2014-1569  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
159654 30194 CVE-2014-1569 openSUSE-SU-2015:0138  View
159655 30194 CVE-2014-1569 SUSE-SU-2015:0171  View
159656 30194 CVE-2014-1569 SUSE-SU-2015:0173  View
159657 30194 CVE-2014-1569 SUSE-SU-2015:0180  View
159658 30194 CVE-2014-1569 openSUSE-SU-2015:0404  View
159659 30194 CVE-2014-1569 DSA-3186  View
159660 30194 CVE-2014-1569 http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf  View
159661 30194 CVE-2014-1569 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
159662 30194 CVE-2014-1569 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html  View
159663 30194 CVE-2014-1569 http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html  View
159664 30194 CVE-2014-1569 https://bugzilla.mozilla.org/show_bug.cgi?id=1064670  View
159665 30194 CVE-2014-1569 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes  View
159666 30194 CVE-2014-1569 https://www.imperialviolet.org/2014/09/26/pkcs1.html  View
159667 30194 CVE-2014-1569 https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18344 JVNDB-2014-007219 Mozilla Network Security Services におけるデータスマグリング攻撃を実行される脆弱性 Mozilla Network Security Services (NSS) の lib/util/quickder.c の definite_length_decoder 関数は、ASN.1 の長さの DER エンコーディングが適切に形成されているかを確認しないため、データスマグリング攻撃を実行される脆弱性が存在します。 CVE-2014-1569 68856 CVE-2014-1569 30194 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007219.html 2014-12-01 2015-10-22 View