Red Hat ENTERPRISE 5.4 RELEASE NOTES, Manual

Page: 197 / 466

nspr and nss
179
1.156. nspr and nss
1.156.1. RHSA-2009:1186: Critical security, bug fix, and
enhancement update
Important
This update has already been released (prior to the GA of this release) as the security
errata
RHSA-2009:1186
1274
Updated nspr and nss packages that fix security issues, bugs, and add an enhancement are now
available for Red Hat Enterprise Linux 5.
This update has been rated as having critical security impact by the Red Hat Security Response
Team.
The packages with this update are identical to the packages released by RHBA-2009:1161 on the
20th of July 2009. They are being reissued as a Red Hat Security Advisory as they fixed a number of
security issues that were made public today. If you are installing these packages for the first time, they
also provide a number of bug fixes and add an enhancement, as detailed in RHBA-2009:1161. Since
the packages are identical, there is no need to install this update if RHBA-2009:1161 has already been
installed.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system
facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval
timing, calendar time, basic memory management (malloc and free), and shared library linking.
Network Security Services (NSS) is a set of libraries designed to support the cross-platform
development of security-enabled client and server applications. Applications built with NSS can
support SSLv2, SSLv3, TLS, and other security standards.
These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version
3.12.4. The version of NSPR has also been upgraded from 4.7.3 to 4.7.4.
Moxie Marlinspike reported a heap overflow flaw in a regular expression parser in the NSS library
used by browsers such as Mozilla Firefox to match common names in certificates. A malicious website
could present a carefully-crafted certificate in such a way as to trigger the heap overflow, leading to
a crash or, possibly, arbitrary code execution with the permissions of the user running the browser.
(
CVE-2009-2404
1275
)
Note: in order to exploit this issue without further user interaction in Firefox, the carefully-crafted
certificate would need to be signed by a Certificate Authority trusted by Firefox, otherwise Firefox
presents the victim with a warning that the certificate is untrusted. Only if the user then accepts the
certificate will the overflow take place.
Dan Kaminsky discovered flaws in the way browsers such as Firefox handle NULL characters in a
certificate. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authority
trusted by Firefox, the attacker could use the certificate during a man-in-the-middle attack and
potentially confuse Firefox into accepting it by mistake. (
CVE-2009-2408
1276
)
1275
https://www.redhat.com/security/data/cve/CVE-2009-2404.html
1276
https://www.redhat.com/security/data/cve/CVE-2009-2408.html