Mozilla Foundation Security Advisory 2007-06
Mozilla Network Security Services (NSS) SSLv2 buffer overflows
- Announced
- February 23, 2007
- Reporter
- iDefense
- Impact
- Critical (Firefox 2.0 not affected in default configuration)
- Products
- Firefox, NSS, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 1.5.0.10
- Firefox 2.0.0.2
- NSS 3.11.5
- SeaMonkey 1.0.8
- Thunderbird 1.5.0.10
Description
iDefense has informed Mozilla about two potential buffer overflow vulnerabilities found by researcher regenrecht in the Network Security Services (NSS) code for processing the SSLv2 protocol.
SSL clients such as Firefox and Thunderbird can suffer a buffer overflow if a malicious server presents a certificate with a public key that is too small to encrypt the entire "Master Secret". Exploiting this overflow appears to be unreliable but possible if the SSLv2 protocol is enabled.
Servers that use NSS for the SSLv2 protocol can be exploited by a client that presents a "Client Master Key" with invalid length values in any of several fields that are used without adequate error checking. This can lead to a buffer overflow that presumably could be exploitable.
Support for SSLv2 is disabled in Firefox 2 due to other known weaknesses in the protocol; Firefox 2 is not vulnerable unless the user has modified hidden internal NSS settings to re-enable SSLv2 support.
Workaround
Disable the SSLv2 protocol in any product that has not already done so.
In Firefox 1.5:
Click on the Advanced icon in the Options/Preferences dialog.
On the Security tab uncheck the box next to "Use SSL 2.0"
click the "OK" button.
In Thunderbird 1.5:
Click on the Advanced icon in the Options/Preferences dialog.
Click the "Config Editor..." button.
Type ssl2 in the Filter field
Double-click security.enable_ssl2 to change the value
to false and close the window.
Server products making use of NSS should also disable the SSLv2 protocol.
Products using the NSS libraries should upgrade to version 3.11.5