Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization
From: Josh Bressers <bressers () redhat com>
Date: Tue, 25 Oct 2011 10:32:56 -0400 (EDT)

Reed asked me to give this a CVE id.

Please use CVE-2011-3640



----- Original Message -----
Hello Josh, Steve, vendors,

   a security flaw was found in the way nss, the Network Security
Services (NSS) set of libraries, performed their initialization (the
file path for "pkcs11.txt" configuration file was constructed
incorrectly). When that configuration file was loaded from remote
or Samba CIFS share, it could lead to arbitrary security module
load, potentially leading to execution of arbitrary code (execution
code from untrusted security module).

Upstream bug report:
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=641052

Other references:
[2] https://secunia.com/advisories/46557/
[3] https://bugs.gentoo.org/show_bug.cgi?id=388045
[4] http://code.google.com/p/chromium/issues/detail?id=97426#c8
[5] https://bugzilla.redhat.com/show_bug.cgi?id=748379

Could you allocate a CVE id for this? (as it looks there isn't one
for this deficiency yet)

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]