Mozilla Network Security Services Library Remote Denial of Service Vulnerability

Bugtraq ID:	18604
Class:	Design Error
CVE:	CVE-2006-3127 CVE-2006-3127
Remote:	Yes
Local:	No
Published:	Jun 22 2006 12:00AM
Updated:	May 07 2015 06:21PM
Credit:	The original discoverer of this issue is currently unknown. This issue was disclosed in the referenced Sun alert.
Vulnerable:	Sun ONE Application Server 7.0 UR2 Upgrade Standard Sun ONE Application Server 7.0 UR2 Upgrade Platform Sun ONE Application Server 7.0 UR2 Standard Edition Sun ONE Application Server 7.0 UR2 Platform Edition Sun ONE Application Server 7.0 UR1 Standard Edition Sun ONE Application Server 7.0 UR1 Platform Edition Sun ONE Application Server 7.0 Standard Edition Sun ONE Application Server 7.0 Platform Edition Sun Java System Web Server 6.0 SP9 Sun Java System Web Server 6.0 SP8 Sun Java System Web Server 6.0 SP7 Sun Java System Web Server 6.0 SP6 Sun Java System Web Server 6.0 SP5 Sun Java System Web Server 6.0 SP4 Sun Java System Web Server 6.0 SP3 Sun Java System Web Server 6.0 SP2 Sun Java System Web Server 6.0 SP1 Sun Java System Web Server 6.0 Sun Java System Directory Server 5.2 Patch4 Sun Java System Directory Server 5.2 Patch3 Sun Java System Directory Server 5.2 Patch2 Sun Java System Directory Server 5.2 Sun Java Enterprise System 2005Q1 + Sun Solaris 9_x86 Update 2 + Sun Solaris 9_x86 + Sun Solaris 9 + Sun Solaris 8_x86 + Sun Solaris 8_sparc + Sun Solaris 10.0_x86 + Sun Solaris 10 Sun Java Enterprise System 2004Q2 + Sun Solaris 9 + Sun Solaris 8_x86 + Sun Solaris 8_sparc Sun Java Enterprise System 2003Q4 + Sun Solaris 9 + Sun Solaris 8_x86 + Sun Solaris 8_sparc Netscape Browser 8.1 Mozilla Thunderbird 1.5.0.4 Mozilla Network Security Services (NSS) 3.11 Mozilla Firefox 1.5.0.4 Mozilla Browser 1.7.13 K-Meleon K-Meleon 0.9.13 Blue Coat Systems Policy Center 8.7 Blue Coat Systems Policy Center 8.6 Blue Coat Systems Policy Center 0 AOL Instant Messenger 5.9.3861 .0
Not Vulnerable:	Sun ONE Application Server 7.0 Update 3 Sun Java System Web Server 6.0 SP10 Blue Coat Systems Policy Center 8.7.2

Mozilla Network Security Services Library Remote Denial of Service Vulnerability

NSS is susceptible to a remote denial-of-service vulnerability. This issue is due to a memory leak in the library.

This issue allows remote attackers to consume excessive memory resources on affected computers. This may lead to computer hangs or panics, denying service to legitimate users.

NSS version 3.11 is affected by this issue.

Mozilla Network Security Services Library Remote Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Mozilla Network Security Services Library Remote Denial of Service Vulnerability

Solution:
Please see the referenced advisories for more information.


Sun Java Enterprise System 2004Q2

• Sun 121656-09
  Sun Java Enterprise System (for linux)
  http://sunsolve.sun.com/search/pdownload.pl?target=121656-09&method=fs

Sun Java Enterprise System 2005Q1

• Sun 121656-09
  Sun Java Enterprise System (for linux)
  http://sunsolve.sun.com/search/pdownload.pl?target=121656-09&method=fs

Sun Java Enterprise System 2003Q4

• Sun 121656-09
  Sun Java Enterprise System (for linux)
  http://sunsolve.sun.com/search/pdownload.pl?target=121656-09&method=fs

Mozilla Network Security Services Library Remote Denial of Service Vulnerability

References:

• Bugzilla Bug 336335 (Mozilla)
  
• Network Security Services (NSS) Product Page (Mozilla)
  
• Sun Alert ID: 102461 (Sun)
  
• Sun Alert ID: 102670 (Sun)
  
• January 10, 2012 - Multiple Sun ONE Directory Server vulnerabilities in PolicyCe (Blue Coat Systems)
  
• Sun Alert ID: 102896 Directory Server May Hang Due to a Memory Leak in the Netwo (Sun)