Mozilla Network Security Services Library Remote Heap Overflow Vulnerability

Bugtraq ID:	11015
Class:	Boundary Condition Error
CVE:	CVE-2004-0826
Remote:	Yes
Local:	No
Published:	Aug 23 2004 12:00AM
Updated:	Jul 14 2008 11:39PM
Credit:	Discovery is credited to Mark Dowd of ISS X-Force.
Vulnerable:	Sun ONE Web Server 6.1 SP2 Sun ONE Web Server 6.1 SP1 Sun ONE Web Server 6.1 Sun ONE Web Server 6.0 SP8 Sun ONE Web Server 6.0 SP7 Sun ONE Web Server 6.0 SP6 Sun ONE Web Server 6.0 SP5 Sun ONE Web Server 6.0 SP4 Sun ONE Web Server 6.0 SP3 Sun ONE Web Server 6.0 SP2 Sun ONE Web Server 6.0 SP1 Sun ONE Web Server 6.0 Sun ONE Web Server 4.1 SP9 Sun ONE Web Server 4.1 SP8 Sun ONE Web Server 4.1 SP7 Sun ONE Web Server 4.1 SP6 Sun ONE Web Server 4.1 SP5 Sun ONE Web Server 4.1 SP5 Sun ONE Web Server 4.1 SP4 Sun ONE Web Server 4.1 SP3 Sun ONE Web Server 4.1 SP2 Sun ONE Web Server 4.1 SP14 Sun ONE Web Server 4.1 SP13 Sun ONE Web Server 4.1 SP12 Sun ONE Web Server 4.1 SP11 Sun ONE Web Server 4.1 SP10 Sun ONE Web Server 4.1 SP1 Sun ONE Web Server 4.1 Sun ONE Directory Server 5.2 Sun ONE Directory Server 5.1 x86 Sun ONE Directory Server 5.1 SP3 x86 Sun ONE Directory Server 5.1 SP3 Sun ONE Directory Server 5.1 SP2 Sun ONE Directory Server 5.1 SP1 Sun ONE Directory Server 5.1 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Redhat Linux 7.2 - Sun Linux 5.0.3 - Sun Linux 5.0 + Sun Solaris 9_x86 + Sun Solaris 9 - Sun Solaris 8_x86 - Sun Solaris 8_sparc Sun ONE Directory Server 5.0 SP2 Sun ONE Directory Server 5.0 SP1 Sun ONE Directory Server 5.0 - HP HP-UX 11.0 - HP HP-UX 11i v1 - IBM AIX 4.3.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Redhat Linux 7.2 - Sun Linux 5.0.3 - Sun Linux 5.0 - Sun Solaris 9_x86 - Sun Solaris 9 - Sun Solaris 8_x86 - Sun Solaris 8_sparc Sun ONE Directory Server 4.16 SP1 Sun ONE Directory Server 4.16 Sun ONE Certificate Server 4.1 Sun ONE Application Server 7.0 UR2 Upgrade Standard Sun ONE Application Server 7.0 UR2 Upgrade Platform Sun ONE Application Server 7.0 UR2 Standard Edition Sun ONE Application Server 7.0 UR2 Platform Edition Sun ONE Application Server 7.0 UR1 Standard Edition Sun ONE Application Server 7.0 UR1 Platform Edition Sun ONE Application Server 7.0 Standard Edition Sun ONE Application Server 7.0 Platform Edition Sun ONE Application Server 6.5 SP1 MU2 Sun ONE Application Server 6.5 SP1 MU1 Sun ONE Application Server 6.5 SP1 Sun ONE Application Server 6.5 MU3 Sun ONE Application Server 6.5 MU2 Sun ONE Application Server 6.5 MU1 Sun ONE Application Server 6.5 Sun ONE Application Server 6.0 SP4 Sun ONE Application Server 6.0 SP3 Sun ONE Application Server 6.0 SP2 Sun ONE Application Server 6.0 SP1 Sun ONE Application Server 6.0 Sun Java System Application Server 7.1 Sun Java System Application Server 7.0 UR4 Sun Java System Application Server 7.0 Standard Edition Sun Java System Application Server 7.0 Platform Edition Sun Java System Application Server 7.0 Enterprise Edition Sun Java Enterprise System 2004Q2 Sun Java Enterprise System 2003Q4 + Sun Solaris 9 + Sun Solaris 8_x86 + Sun Solaris 8_sparc Netscape Personalization Engine Netscape Enterprise Server for Solaris 3.6 Netscape Enterprise Server for Solaris 3.5 Netscape Enterprise Server for NetWare 4/5 5.0 Netscape Enterprise Server for NetWare 4/5 4.1.1 Netscape Enterprise Server for NetWare 4/5 3.0.7 a - Novell Netware 5.0 - Novell Netware 4.11 SP5B - Novell Netware 4.11 Netscape Enterprise Server 4.1 SP8 Netscape Enterprise Server 4.1 SP7 Netscape Enterprise Server 4.1 SP6 Netscape Enterprise Server 4.1 SP5 Netscape Enterprise Server 4.1 SP4 Netscape Enterprise Server 4.1 SP3 Netscape Enterprise Server 4.0 Netscape Enterprise Server 3.51 - Digital UNIX 4.0 D - HP HP-UX 10.10 - IBM AIX 4.1.5 - Microsoft Windows NT 4.0 - SGI IRIX 6.2 - Sun Solaris 2.5.1 Netscape Enterprise Server 3.6 SP3 Netscape Enterprise Server 3.6 SP2 Netscape Enterprise Server 3.6 SP1 Netscape Enterprise Server 3.6 - Compaq Tru64 4.0 d - Digital UNIX 4.0 B - HP HP-UX 11.0 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 - SGI IRIX 6.5 - SGI IRIX 6.2 - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Netscape Enterprise Server 3.5 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.4 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.3 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.2 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.1 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.0.1 B Netscape Enterprise Server 3.0.1 Netscape Enterprise Server 3.0 L Netscape Enterprise Server 3.0 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 2.0.1 C Netscape Enterprise Server 2.0 a Netscape Enterprise Server 2.0 Netscape Directory Server 4.13 Netscape Directory Server 4.12 Netscape Directory Server 4.11 Netscape Directory Server 4.1 Netscape Directory Server 3.12 Netscape Directory Server 3.1 P1 Netscape Directory Server 1.3 P5 Netscape Certificate Server 4.2 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Netscape Certificate Server 1.0 P1 Mozilla Network Security Services (NSS) 3.9 + Mozilla Browser 1.5 Mozilla Network Security Services (NSS) 3.8 + Galeon Galeon Browser 1.2.13 + Mozilla Browser 1.4.1 + Mozilla Browser 1.4.1 + Mozilla Browser 1.4 b + Mozilla Browser 1.4 b + Mozilla Browser 1.4 a + Mozilla Browser 1.4 a + Mozilla Browser 1.4 + Mozilla Browser 1.4 Mozilla Network Security Services (NSS) 3.7.7 Mozilla Network Security Services (NSS) 3.7.5 Mozilla Network Security Services (NSS) 3.7.3 Mozilla Network Security Services (NSS) 3.7.2 Mozilla Network Security Services (NSS) 3.7.1 Mozilla Network Security Services (NSS) 3.7 Mozilla Network Security Services (NSS) 3.6.1 Mozilla Network Security Services (NSS) 3.6 Mozilla Network Security Services (NSS) 3.5 Mozilla Network Security Services (NSS) 3.4.2 Mozilla Network Security Services (NSS) 3.4.1 Mozilla Network Security Services (NSS) 3.4 Mozilla Network Security Services (NSS) 3.3.2 Mozilla Network Security Services (NSS) 3.3.1 Mozilla Network Security Services (NSS) 3.3 Mozilla Network Security Services (NSS) 3.2.1 Mozilla Network Security Services (NSS) 3.2 HP HP-UX B.11.23 HP HP-UX B.11.11 HP HP-UX B.11.00
Not Vulnerable:	Mozilla Network Security Services (NSS) 3.9.2

Mozilla Network Security Services Library Remote Heap Overflow Vulnerability

NSS is prone to a remote heap-overflow vulnerability because it fails to perform sufficient boundary checks. Successful exploits may allow arbitrary code to run and may grant the attacker unauthorized access to a vulnerable computer.

The NSS library is commonly used by Netscape Enterprise Server and Sun One/iPlanet servers. The SSLv2 protocol is not enabled by default on these servers. Other products may be affected as well.

Mozilla Network Security Services Library Remote Heap Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Mozilla Network Security Services Library Remote Heap Overflow Vulnerability

Solution:
Updates are available. Please see the references for details.


Sun Java Enterprise System 2003Q4

• Sun 114045-12
  Solaris 8 Sparc
  http://sunsolve.sun.com/search/pdownload.pl?target=114045-12&method=f


• Sun 114049-12
  Solaris 9 Sparc
  http://sunsolve.sun.com/search/pdownload.pl?target=114049-12&method=f


• Sun 114050-12
  Solaris 9 x86
  http://sunsolve.sun.com/search/pdownload.pl?target=114050-12&method=f


• Sun 115924-09
  Solaris 8 Sparc
  http://sunsolve.sun.com/search/pdownload.pl?target=115924-09&method=f


• Sun 115926-10
  Solaris 9 Sparc
  http://sunsolve.sun.com/search/pdownload.pl?target=115926-10&method=f


• Sun 115927-10
  Solaris 9 x86
  http://sunsolve.sun.com/search/pdownload.pl?target=115927-10&method=f

Mozilla Network Security Services (NSS) 3.2

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.2.1

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.3

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.3.2

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.4

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.5

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.6.1

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.7.2

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.7.3

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.7.5

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.7.7

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.8

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Mozilla Network Security Services (NSS) 3.9

• Mozilla NSS_3_9_2_RTM
  ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_ RTM/

Sun Java System Application Server 7.0 Platform Edition

• Sun Sun Java System Application Server 7 2004Q2 Update 1
  http://wwws.sun.com/software/download/products/4154c5a5.html


• Sun Sun Java System Application Server Platform Edition 7 Update 5
  http://wwws.sun.com/software/download/products/4151fe59.html

Mozilla Network Security Services Library Remote Heap Overflow Vulnerability

References:

• Netscape NSS Library Remote Compromise (ISS)
  
• Network Security Services (NSS) Product Page (Mozilla)
  
• Sun Alert ID: 57632 (Sun)
  
• Sun Alert ID: 57643 (Sun)
  
• Sun ONE Web Server-NSS challenge overflow exploit (CORE Security)