Synopsis

Moderate: nss and nspr security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

Updated nss and nspr packages that fix multiple security issues, several
bugs, and add various enhancements are now available for Red Hat Enterprise
Linux 5.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications.

A flaw was found in the way TLS False Start was implemented in NSS.
An attacker could use this flaw to potentially return unencrypted
information from the server. (CVE-2013-1740)

A race condition was found in the way NSS implemented session ticket
handling as specified by RFC 5077. An attacker could use this flaw to crash
an application using NSS or, in rare cases, execute arbitrary code with the
privileges of the user running that application. (CVE-2014-1490)

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE)
parameters. This could possibly lead to weak encryption being used in
communication between the client and the server. (CVE-2014-1491)

An out-of-bounds write flaw was found in NSPR. A remote attacker could
potentially use this flaw to crash an application using NSPR or, possibly,
execute arbitrary code with the privileges of the user running that
application. This NSPR flaw was not exposed to web content in any shipped
version of Firefox. (CVE-2014-1545)

It was found that the implementation of Internationalizing Domain Names in
Applications (IDNA) hostname matching in NSS did not follow the RFC 6125
recommendations. This could lead to certain invalid certificates with
international characters to be accepted as valid. (CVE-2014-1492)

Red Hat would like to thank the Mozilla project for reporting the
CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream
acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine
Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of
CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545.

The nss and nspr packages have been upgraded to upstream version 3.16.1 and
4.10.6 respectively, which provide a number of bug fixes and enhancements
over the previous versions. (BZ#1110857, BZ#1110860)

This update also fixes the following bugs:

• Previously, when the output.log file was not present on the system, the
  shell in the Network Security Services (NSS) specification handled test
  failures incorrectly as false positive test results. Consequently, certain
  utilities, such as "grep", could not handle failures properly. This update
  improves error detection in the specification file, and "grep" and other
  utilities now handle missing files or crashes as intended. (BZ#1035281)
  
• Prior to this update, a subordinate Certificate Authority (CA) of the
  ANSSI agency incorrectly issued an intermediate certificate installed on a
  network monitoring device. As a consequence, the monitoring device was
  enabled to act as an MITM (Man in the Middle) proxy performing traffic
  management of domain names or IP addresses that the certificate holder did
  not own or control. The trust in the intermediate certificate to issue the
  certificate for an MITM device has been revoked, and such a device can no
  longer be used for MITM attacks. (BZ#1042684)
  
• Due to a regression, MD5 certificates were rejected by default because
  Network Security Services (NSS) did not trust MD5 certificates. With this
  update, MD5 certificates are supported in Red Hat Enterprise Linux 5.
  (BZ#11015864)
  

Users of nss and nspr are advised to upgrade to these updated packages,
which correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 1035281 - Suboptimal shell code in nss.spec
• BZ - 1053725 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
• BZ - 1060953 - CVE-2014-1490 nss: TOCTOU, potential use-after-free in libssl's session ticket processing (MFSA 2014-12)
• BZ - 1060955 - CVE-2014-1491 nss: Do not allow p-1 as a public DH value (MFSA 2014-12)
• BZ - 1079851 - CVE-2014-1492 nss: IDNA hostname matching code does not follow RFC 6125 recommendation (MFSA 2014-45)
• BZ - 1107432 - CVE-2014-1545 Mozilla: Out of bounds write in NSPR (MFSA 2014-55)
• BZ - 1110857 - Rebase nspr in RHEL 5.11 to NSPR 4.10.6 (required for FF31)
• BZ - 1110860 - Rebase nss in RHEL 5.11 to NSS 3.16.1 (required for FF 31)

CVEs

• CVE-2014-1490
• CVE-2013-1740
• CVE-2014-1492
• CVE-2014-1545
• CVE-2014-1491

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
nss-3.16.1-2.el5.src.rpm	SHA-256: 31772696f7a4955bc155eefaf9b3aabe7eebf22f555b191dad087e275bbf5953
x86_64
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-3.16.1-2.el5.x86_64.rpm	SHA-256: 4dfcabec3b8a10beab3bb4dde255c21816701fc7a60aded4f993d379875f6a2c
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.x86_64.rpm	SHA-256: 36170354164c098dbc5f9d24787bd476b8a6bc1fadfc688b43b58e1db3920368
nss-devel-3.16.1-2.el5.i386.rpm	SHA-256: 6a21805481a8b85f0447298dc0fb997e69499dfe1971c9bc6d7ddbb7d522b30f
nss-devel-3.16.1-2.el5.x86_64.rpm	SHA-256: ff9151119e9f872015977f029cefc1a17eb62e7825c3b5d33cddd26924b35403
nss-pkcs11-devel-3.16.1-2.el5.i386.rpm	SHA-256: a16d0eacdaf71b7a32c98e4fe66e83ff0eeb0aed2f1ca85a2eed94a49081faf9
nss-pkcs11-devel-3.16.1-2.el5.x86_64.rpm	SHA-256: 09e68e5a476d7eb0c30a985918869f7c4f1b9dce3a1adb7d01d33727018e72c1
nss-tools-3.16.1-2.el5.x86_64.rpm	SHA-256: bdc7101ff6647d4029e82431254cab287f94c75bb9405667de012e7b459a0eed
ia64
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-3.16.1-2.el5.ia64.rpm	SHA-256: 332ef1ef5d4fedfc31aa6b7fdbf8a584a599336a3b9eeea8d9e2885a58375086
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.ia64.rpm	SHA-256: a1563863257d92cb8278dc9ccbe96164ad3d753914b01d6c31a5c04b2703620b
nss-devel-3.16.1-2.el5.ia64.rpm	SHA-256: 179d986010cc513a3fdfa8b633b4c86966cb9e95d39a28feccf8c71166fa79f1
nss-pkcs11-devel-3.16.1-2.el5.ia64.rpm	SHA-256: 01bbfef99861d02050519a888d3ac0076533118acfb5088ed970bf60c311c65e
nss-tools-3.16.1-2.el5.ia64.rpm	SHA-256: 71c1b2f8a7e6218fe075d23849649f7982d2765798ea0d08791dd595cb6ee780
i386
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-devel-3.16.1-2.el5.i386.rpm	SHA-256: 6a21805481a8b85f0447298dc0fb997e69499dfe1971c9bc6d7ddbb7d522b30f
nss-pkcs11-devel-3.16.1-2.el5.i386.rpm	SHA-256: a16d0eacdaf71b7a32c98e4fe66e83ff0eeb0aed2f1ca85a2eed94a49081faf9
nss-tools-3.16.1-2.el5.i386.rpm	SHA-256: bda1731124fb81153c693c1c29e50ea775d688699fb8c29f4eb7a200be69af42

Red Hat Enterprise Linux Workstation 5

SRPM
nss-3.16.1-2.el5.src.rpm	SHA-256: 31772696f7a4955bc155eefaf9b3aabe7eebf22f555b191dad087e275bbf5953
x86_64
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-3.16.1-2.el5.x86_64.rpm	SHA-256: 4dfcabec3b8a10beab3bb4dde255c21816701fc7a60aded4f993d379875f6a2c
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.x86_64.rpm	SHA-256: 36170354164c098dbc5f9d24787bd476b8a6bc1fadfc688b43b58e1db3920368
nss-debuginfo-3.16.1-2.el5.x86_64.rpm	SHA-256: 36170354164c098dbc5f9d24787bd476b8a6bc1fadfc688b43b58e1db3920368
nss-devel-3.16.1-2.el5.i386.rpm	SHA-256: 6a21805481a8b85f0447298dc0fb997e69499dfe1971c9bc6d7ddbb7d522b30f
nss-devel-3.16.1-2.el5.x86_64.rpm	SHA-256: ff9151119e9f872015977f029cefc1a17eb62e7825c3b5d33cddd26924b35403
nss-pkcs11-devel-3.16.1-2.el5.i386.rpm	SHA-256: a16d0eacdaf71b7a32c98e4fe66e83ff0eeb0aed2f1ca85a2eed94a49081faf9
nss-pkcs11-devel-3.16.1-2.el5.x86_64.rpm	SHA-256: 09e68e5a476d7eb0c30a985918869f7c4f1b9dce3a1adb7d01d33727018e72c1
nss-tools-3.16.1-2.el5.x86_64.rpm	SHA-256: bdc7101ff6647d4029e82431254cab287f94c75bb9405667de012e7b459a0eed
i386
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-devel-3.16.1-2.el5.i386.rpm	SHA-256: 6a21805481a8b85f0447298dc0fb997e69499dfe1971c9bc6d7ddbb7d522b30f
nss-pkcs11-devel-3.16.1-2.el5.i386.rpm	SHA-256: a16d0eacdaf71b7a32c98e4fe66e83ff0eeb0aed2f1ca85a2eed94a49081faf9
nss-tools-3.16.1-2.el5.i386.rpm	SHA-256: bda1731124fb81153c693c1c29e50ea775d688699fb8c29f4eb7a200be69af42

Red Hat Enterprise Linux Desktop 5

SRPM
nss-3.16.1-2.el5.src.rpm	SHA-256: 31772696f7a4955bc155eefaf9b3aabe7eebf22f555b191dad087e275bbf5953
x86_64
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-3.16.1-2.el5.x86_64.rpm	SHA-256: 4dfcabec3b8a10beab3bb4dde255c21816701fc7a60aded4f993d379875f6a2c
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.x86_64.rpm	SHA-256: 36170354164c098dbc5f9d24787bd476b8a6bc1fadfc688b43b58e1db3920368
nss-tools-3.16.1-2.el5.x86_64.rpm	SHA-256: bdc7101ff6647d4029e82431254cab287f94c75bb9405667de012e7b459a0eed
i386
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-tools-3.16.1-2.el5.i386.rpm	SHA-256: bda1731124fb81153c693c1c29e50ea775d688699fb8c29f4eb7a200be69af42

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
nss-3.16.1-2.el5.src.rpm	SHA-256: 31772696f7a4955bc155eefaf9b3aabe7eebf22f555b191dad087e275bbf5953
s390x
nss-3.16.1-2.el5.s390.rpm	SHA-256: aa061034a06b38193b58a072dbba65aedb831bddd52192cf73030de423250896
nss-3.16.1-2.el5.s390x.rpm	SHA-256: de95470c1d948c2eaf9cab6ae63a30c0998bf8f00b38b9a4579d81ee77bbea76
nss-debuginfo-3.16.1-2.el5.s390.rpm	SHA-256: b7a48a2847c1410e50dacec9829e85c5e2d973940f8d629b3405131ba4776673
nss-debuginfo-3.16.1-2.el5.s390x.rpm	SHA-256: fec88abb7f5b4c8c9a2d66b3cd9674ec82f212e1fc13611281dd968784e5d37a
nss-devel-3.16.1-2.el5.s390.rpm	SHA-256: 9a1a6a658d3ba36728403eb9d269d58b4007ff8661c8c0d5f018acfa4be38e30
nss-devel-3.16.1-2.el5.s390x.rpm	SHA-256: 151eb8e811f128be430631695cb8bb1bb95c8976237a68cab26d3f7f27a8b360
nss-pkcs11-devel-3.16.1-2.el5.s390.rpm	SHA-256: ab8d4fab90fe28ee6bcf2c620eccf91c12c66356541bed9a94d96013e947e9db
nss-pkcs11-devel-3.16.1-2.el5.s390x.rpm	SHA-256: 0dcae9f0362f9c9480e8e866ce7546d88e58cae033c461700652ba3c0621a43d
nss-tools-3.16.1-2.el5.s390x.rpm	SHA-256: 1885cff7f3d4839bcbae660bdac674fb0aaa658021ea6b006cfb5db7e4745fe1

Red Hat Enterprise Linux for Power, big endian 5

SRPM
nss-3.16.1-2.el5.src.rpm	SHA-256: 31772696f7a4955bc155eefaf9b3aabe7eebf22f555b191dad087e275bbf5953
ppc
nss-3.16.1-2.el5.ppc.rpm	SHA-256: 3f0829151a57e33333c3070ed73856bfe00944d217bc8cfb13a5a510748bfb0c
nss-3.16.1-2.el5.ppc64.rpm	SHA-256: f1666081b3771868ed31af39e4037a97988371e26ea6004161cd36a4379db6cf
nss-debuginfo-3.16.1-2.el5.ppc.rpm	SHA-256: 628475635adac639ae1f4e2256dbb3ccdf50296adcde6f3c5d6d2aa5921fe832
nss-debuginfo-3.16.1-2.el5.ppc64.rpm	SHA-256: 8b247521e3a89d93ea2a23d15e32de1029cb0949e1e87624ab5facf225b8229d
nss-devel-3.16.1-2.el5.ppc.rpm	SHA-256: b7fc428ebf9684f120ecee69e5f57f88bea3688ff590f7b1e8e2be2673ec4098
nss-devel-3.16.1-2.el5.ppc64.rpm	SHA-256: 357f2bef08aba0a7611c59666c4e7531b3e0adb39b49321f4fd189f82899aa9e
nss-pkcs11-devel-3.16.1-2.el5.ppc.rpm	SHA-256: b18153ebbb121aca116ec59c9f941308260770a15a77ca12c5682d2f97f62c06
nss-pkcs11-devel-3.16.1-2.el5.ppc64.rpm	SHA-256: b70b827466142d5c49b5d15eea3d002084d802231117ac7a0933c87d230ac0c6
nss-tools-3.16.1-2.el5.ppc.rpm	SHA-256: 9a790885fce62d41af4b498b54d64112d53fa2cb393f267b736f2027e0de08d3

Red Hat Enterprise Linux Server from RHUI 5

SRPM
nss-3.16.1-2.el5.src.rpm	SHA-256: 31772696f7a4955bc155eefaf9b3aabe7eebf22f555b191dad087e275bbf5953
x86_64
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-3.16.1-2.el5.x86_64.rpm	SHA-256: 4dfcabec3b8a10beab3bb4dde255c21816701fc7a60aded4f993d379875f6a2c
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-debuginfo-3.16.1-2.el5.x86_64.rpm	SHA-256: 36170354164c098dbc5f9d24787bd476b8a6bc1fadfc688b43b58e1db3920368
nss-devel-3.16.1-2.el5.i386.rpm	SHA-256: 6a21805481a8b85f0447298dc0fb997e69499dfe1971c9bc6d7ddbb7d522b30f
nss-devel-3.16.1-2.el5.x86_64.rpm	SHA-256: ff9151119e9f872015977f029cefc1a17eb62e7825c3b5d33cddd26924b35403
nss-pkcs11-devel-3.16.1-2.el5.i386.rpm	SHA-256: a16d0eacdaf71b7a32c98e4fe66e83ff0eeb0aed2f1ca85a2eed94a49081faf9
nss-pkcs11-devel-3.16.1-2.el5.x86_64.rpm	SHA-256: 09e68e5a476d7eb0c30a985918869f7c4f1b9dce3a1adb7d01d33727018e72c1
nss-tools-3.16.1-2.el5.x86_64.rpm	SHA-256: bdc7101ff6647d4029e82431254cab287f94c75bb9405667de012e7b459a0eed
i386
nss-3.16.1-2.el5.i386.rpm	SHA-256: f60c7b678194ec02b34577b923bf71bc0dab2701e32a5b0710e11de9fd58b7af
nss-debuginfo-3.16.1-2.el5.i386.rpm	SHA-256: 98421882e6b080a8e58f7996f8b42218b14defd41416d10592c072a5bb20fda4
nss-devel-3.16.1-2.el5.i386.rpm	SHA-256: 6a21805481a8b85f0447298dc0fb997e69499dfe1971c9bc6d7ddbb7d522b30f
nss-pkcs11-devel-3.16.1-2.el5.i386.rpm	SHA-256: a16d0eacdaf71b7a32c98e4fe66e83ff0eeb0aed2f1ca85a2eed94a49081faf9
nss-tools-3.16.1-2.el5.i386.rpm	SHA-256: bda1731124fb81153c693c1c29e50ea775d688699fb8c29f4eb7a200be69af42