The remote host is affected by the vulnerability described in GLSA-202212-05 (Mozilla Network Security Service (NSS):
Multiple Vulnerabilities)
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
(CVE-2021-43527)
A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash. (CVE-2022-3479)
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# @NOAGENT@
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 202212-05.
#
# The advisory text is Copyright (C) 2001-2021 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#
include('compat.inc');
if (description)
{
script_id(168908);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/15");
script_cve_id("CVE-2021-43527", "CVE-2022-1097", "CVE-2022-3479");
script_name(english:"GLSA-202212-05 : Mozilla Network Security Service (NSS): Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"");
script_set_attribute(attribute:"description", value:
"The remote host is affected by the vulnerability described in GLSA-202212-05 (Mozilla Network Security Service (NSS):
Multiple Vulnerabilities)
- NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow
when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures
encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for
certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how
they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and
PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and
Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
(CVE-2021-43527)
- A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user
certificate in the database and this can lead us to a segmentation fault or crash. (CVE-2022-3479)
- <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe
way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://security.gentoo.org/glsa/202212-05");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=827946");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=836386");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=848984");
script_set_attribute(attribute:"see_also", value:"https://bugs.gentoo.org/show_bug.cgi?id=877169");
script_set_attribute(attribute:"solution", value:
"All Mozilla Network Security Service (NSS) users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose >=dev-libs/nss-3.79.2");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-43527");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2021/12/01");
script_set_attribute(attribute:"patch_publication_date", value:"2022/12/19");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/12/18");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:nss");
script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Gentoo Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
exit(0);
}
include('qpkg.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/Gentoo/release')) audit(AUDIT_OS_NOT, 'Gentoo');
if (!get_kb_item('Host/Gentoo/qpkg-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var flag = 0;
var packages = [
{
'name' : 'dev-libs/nss',
'unaffected' : make_list("ge 3.79.2"),
'vulnerable' : make_list("lt 3.79.2")
}
];
foreach var package( packages ) {
if (isnull(package['unaffected'])) package['unaffected'] = make_list();
if (isnull(package['vulnerable'])) package['vulnerable'] = make_list();
if (qpkg_check(package: package['name'] , unaffected: package['unaffected'], vulnerable: package['vulnerable'])) flag++;
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : qpkg_report_get()
);
exit(0);
}
else
{
qpkg_tests = list_uniq(qpkg_tests);
var tested = qpkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Mozilla Network Security Service (NSS)');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1097
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3479
bugs.gentoo.org/show_bug.cgi?id=827946
bugs.gentoo.org/show_bug.cgi?id=836386
bugs.gentoo.org/show_bug.cgi?id=848984
bugs.gentoo.org/show_bug.cgi?id=877169
security.gentoo.org/glsa/202212-05