Pardus alert 2010-20 (nss)
| From: | Eren Turkay <eren@pardus.org.tr> | |
| To: | pardus-security@pardus.org.tr | |
| Subject: | [Pardus-security] [PLSA 2010-20] [UPDATE] Nss: TLS Implementation MITM Attack | |
| Date: | Thu, 4 Feb 2010 16:01:42 +0200 (EET) | |
| Message-ID: | <20100204140142.E5960A7AB3B@lider.pardus.org.tr> |
------------------------------------------------------------------------ Pardus Linux Security Advisory 2010-20 security@pardus.org.tr ------------------------------------------------------------------------ Date: 2010-02-04 Severity: 4 Type: Remote ------------------------------------------------------------------------ Summary ======= A serious vulnerability was found in TLS/SSLv3 protocol as implemented in nss, which can be used by man-in-the-middle attackers to send arbitrary requests to the server as if legitimate user. [UPDATE] The issue is fixed in Pardus 2008 Description =========== The TLS/SSLv3 protocol as implemented in nss prior to this update was not able to associate already sent data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's mod_ssl was vulnerable to this kind of attack because it uses openssl. NOTE: This is the same as PLSA-2009-191.With this update,renegotiation is completely disabled. Affected packages: Pardus 2009: nss, all before 3.12.5.0-29-8 Resolution ========== There are update(s) for nss. You can update them via Package Manager or with a single command from console: pisi up nss References ========== * http://bugs.pardus.org.tr/show_bug.cgi?id=12147 * http://bugs.pardus.org.tr/show_bug.cgi?id=11515 * https://developer.mozilla.org/NSS_3.12.5_release_notes * https://bugzilla.mozilla.org/show_bug.cgi?id=526689 ------------------------------------------------------------------------ _______________________________________________ Pardus-security mailing list Pardus-security@pardus.org.tr http://liste.pardus.org.tr/mailman/listinfo/pardus-security