SSL: Mozilla Network Security Services RSA Signature Forgery
Mozilla's Network Security Services suffer from signature forgery. The vulnerability is a result of improper verification of RSA signatures due to incorrect ASN.1 parsing. A remote attacker could exploit this vulnerability by providing a forged certificate.
Extended Description
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
Affected Products
Mozilla seamonkey
Short Name
SSL:MOZILLA-NSS-RSA-SIG-FORGERY
Severity
Major
Recommended
False
Recommended Action
Drop
Category
SSL
Keywords
CVE-2014-1568 Forgery Mozilla Network RSA Security Services Signature bid:70116
Release Date
11/05/2014
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3751
False Positive
Unknown
Vendors
Mozilla
CVSS Score
7.5