[ MDVSA-2014:252 ] nss

2014-12-22T00:00:00
ID SECURITYVULNS:DOC:31532
Type securityvulns
Reporter Securityvulns
Modified 2014-12-22T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:252 http://www.mandriva.com/en/support/security/


Package : nss Date : December 15, 2014 Affected: Business Server 1.0


Problem Description:

Updated nss packages fix security vulnerabilities:

In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data (CVE-2014-1569).

This update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE.


References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569 http://advisories.mageia.org/MGASA-2014-0507.html https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes


Updated Packages:

Mandriva Business Server 1/X86_64: fc10a003360b8afb464df7b305c18127 mbs1/x86_64/lib64nss3-3.17.3-1.mbs1.x86_64.rpm d905a80bfbca9dfe020ca223b4778e61 mbs1/x86_64/lib64nss-devel-3.17.3-1.mbs1.x86_64.rpm 8fc7041f46189c8c0c89db593ee5da11 mbs1/x86_64/lib64nss-static-devel-3.17.3-1.mbs1.x86_64.rpm fbdbd1016983804aecd74764b106642b mbs1/x86_64/nss-3.17.3-1.mbs1.x86_64.rpm 7c0c88abd44a83fb87304d677977e183 mbs1/x86_64/nss-doc-3.17.3-1.mbs1.noarch.rpm ef3f32df47bcf9ced2ecb14b5bcd1439 mbs1/x86_64/rootcerts-20141117.00-1.mbs1.x86_64.rpm b7b5939180d3f43310e1ee31e11bf087 mbs1/x86_64/rootcerts-java-20141117.00-1.mbs1.x86_64.rpm cdd11c0294e9c4dc54a896cd3e4c6170 mbs1/SRPMS/nss-3.17.3-1.mbs1.src.rpm f5e57b2f9ff644f36a26e2c80759accc mbs1/SRPMS/rootcerts-20141117.00-1.mbs1.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUjrQDmqjQ0CJFipgRAiUvAJ9meLgw3zNCQfXMfIO4VWcIwFqrKACglVBu 6kKTP01FwHyn4dFFz1WDHRU= =k8XV -----END PGP SIGNATURE-----