CVE-2014-1492

Mozilla Network Security Services < 3.16 - Certificate Hostname Validation Spoofing via Wildcard in U-label

Title source: llm
STIX 2.1

Description

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

References (27)

Core 27
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2994
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-05/msg00010.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-05/msg00033.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/534161/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60621
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60794
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201504-01
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59866
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=903885
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Dec/23
Exploit, Patch x_refsource_confirm
https://hg.mozilla.org/projects/nss/rev/709d4e597979
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2185-1
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1079851
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/66356
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2159-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html

Scores

EPSS 0.0083
EPSS Percentile 74.8%

Details

CWE
CWE-20
Status published
Products (50)
mozilla/network_security_services 3.2
mozilla/network_security_services 3.2.1
mozilla/network_security_services 3.3
mozilla/network_security_services 3.3.1
mozilla/network_security_services 3.3.2
mozilla/network_security_services 3.4
mozilla/network_security_services 3.4.1
mozilla/network_security_services 3.4.2
mozilla/network_security_services 3.5
mozilla/network_security_services 3.6
... and 40 more
Published Mar 25, 2014
Tracked Since Feb 18, 2026