CVE-2014-1492

2014-03-2513:25:00

CWE-20

[email protected]

web.nvd.nist.gov

3635

cve-2014-1492

nss

ssl

spoofing

vulnerability

crafted certificate

5.9 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

52.6%

JSON

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name’s U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

CPENameOperatorVersion
mozilla:network_security_servicesmozilla network security serviceseq3.11.2
mozilla:network_security_servicesmozilla network security serviceseq3.6.1
mozilla:network_security_servicesmozilla network security serviceseq3.12.5
mozilla:network_security_servicesmozilla network security serviceseq3.2
mozilla:network_security_servicesmozilla network security serviceseq3.15
mozilla:network_security_servicesmozilla network security serviceseq3.11.4
mozilla:network_security_servicesmozilla network security serviceseq3.7.7
mozilla:network_security_servicesmozilla network security serviceseq3.14.1
mozilla:network_security_servicesmozilla network security serviceseq3.7.5
mozilla:network_security_servicesmozilla network security serviceseq3.7.1

CPE	Name	Operator	Version
mozilla:network_security_services	mozilla network security services	eq	3.11.2
mozilla:network_security_services	mozilla network security services	eq	3.6.1
mozilla:network_security_services	mozilla network security services	eq	3.12.5
mozilla:network_security_services	mozilla network security services	eq	3.2
mozilla:network_security_services	mozilla network security services	eq	3.15
mozilla:network_security_services	mozilla network security services	eq	3.11.4
mozilla:network_security_services	mozilla network security services	eq	3.7.7
mozilla:network_security_services	mozilla network security services	eq	3.14.1
mozilla:network_security_services	mozilla network security services	eq	3.7.5
mozilla:network_security_services	mozilla network security services	eq	3.7.1