Vulnerabilidad en Mozilla Network Security Services (CVE-2014-1491)
Gravedad CVSS v2.0:
MEDIA
Tipo:
CWE-326
Fortaleza de cifrado inadecuada
Fecha de publicación:
06/02/2014
Última modificación:
25/11/2025
Descripción
Mozilla Network Security Services (NSS) anterior a 3.15.4, utilizado en Mozilla Firefox anterior a 27.0, Firefox ESR 24.x anterior a 24.3, Thunderbird anterior a 24.3, SeaMonkey anterior a 2.24 y otros productos, no restringe debidamente los valores públicos en el intercambio de claves de Diffie-Hellman, lo que facilita a atacantes remotos evadir mecanismos de protección criptográfica en el manejo de tickets mediante el aprovechamiento de un cierto valor.
Impacto
Puntuación base 2.0
4.30
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | 24.3 (excluyendo) | |
| cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | 27.0 (excluyendo) | |
| cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* | 3.15.4 (excluyendo) | |
| cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* | 2.24 (excluyendo) | |
| cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | 24.3.0 (excluyendo) | |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:* | 12.1.4 (excluyendo) | |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:* | ||
| cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:* | ||
| cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:* | ||
| cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* | ||
| cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* | ||
| cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://hg.mozilla.org/projects/nss/rev/12c42006aed8
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://secunia.com/advisories/56858
- http://secunia.com/advisories/56888
- http://secunia.com/advisories/56922
- http://www.debian.org/security/2014/dsa-2858
- http://www.debian.org/security/2014/dsa-2994
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://www.securityfocus.com/bid/65332
- http://www.securitytracker.com/id/1029717
- http://www.securitytracker.com/id/1029720
- http://www.securitytracker.com/id/1029721
- http://www.ubuntu.com/usn/USN-2102-1
- http://www.ubuntu.com/usn/USN-2102-2
- http://www.ubuntu.com/usn/USN-2119-1
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=934545
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90886
- https://security.gentoo.org/glsa/201504-01
- http://hg.mozilla.org/projects/nss/rev/12c42006aed8
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://secunia.com/advisories/56858
- http://secunia.com/advisories/56888
- http://secunia.com/advisories/56922
- http://www.debian.org/security/2014/dsa-2858
- http://www.debian.org/security/2014/dsa-2994
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://www.securityfocus.com/bid/65332
- http://www.securitytracker.com/id/1029717
- http://www.securitytracker.com/id/1029720
- http://www.securitytracker.com/id/1029721
- http://www.ubuntu.com/usn/USN-2102-1
- http://www.ubuntu.com/usn/USN-2102-2
- http://www.ubuntu.com/usn/USN-2119-1
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=934545
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90886
- https://security.gentoo.org/glsa/201504-01