Denial of service in Mozilla NSS
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2016-9574 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Mozilla NSS Universal components / Libraries / Libraries used by multiple products |
| Vendor | Mozilla |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Improper input validation
EUVDB-ID: #VU13994
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-9574
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system..
The vulnerability exists in the Mozilla Network Security Services (NSS) library due to improper handling of session handshake packets when the affected software uses a SessionTicket extension and Elliptic Curve Diffie-Hellman Exchange-Elliptic Curve Digital Signature Algorithm (ECDHE-ECDSA) certificates. A remote attacker can send specially crafted packets that submit malicious input to an application on a targeted system that has been compiled with the vulnerable library and cause the server application to crash.
MitigationUpdate to version 3.30 or later.
Vulnerable software versionsMozilla NSS: 3.24 - 3.28.5
External linkshttp://bugzilla.mozilla.org/show_bug.cgi?id=1320695
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
