National Cyber Awareness System

Vulnerability Summary for CVE-2007-0008

Overview

Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#377812

Name: VU#377812

Hyperlink:http://www.kb.cert.org/vuls/id/377812

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2007/mfsa2007-06.html

Type: Advisory; Patch Information

Hyperlink:http://www.mozilla.org/security/announce/2007/mfsa2007-06.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1103

Hyperlink:https://issues.rpath.com/browse/RPL-1103

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1081

Hyperlink:https://issues.rpath.com/browse/RPL-1081

External Source: MISC

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=364319

Type: Advisory

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=364319

External Source: XF

Name: nss-mastersecret-bo(32666)

Hyperlink:http://xforce.iss.net/xforce/xfdb/32666

External Source: VUPEN

Name: ADV-2007-2141

Hyperlink:http://www.vupen.com/english/advisories/2007/2141

External Source: VUPEN

Name: ADV-2007-1165

Hyperlink:http://www.vupen.com/english/advisories/2007/1165

External Source: VUPEN

Name: ADV-2007-0719

Hyperlink:http://www.vupen.com/english/advisories/2007/0719

External Source: VUPEN

Name: ADV-2007-0718

Hyperlink:http://www.vupen.com/english/advisories/2007/0718

External Source: UBUNTU

Name: USN-431-1

Hyperlink:http://www.ubuntu.com/usn/usn-431-1

External Source: UBUNTU

Name: USN-428-1

Hyperlink:http://www.ubuntu.com/usn/usn-428-1

External Source: SECTRACK

Name: 1017696

Hyperlink:http://www.securitytracker.com/id?1017696

External Source: BID

Name: 22694

Hyperlink:http://www.securityfocus.com/bid/22694

External Source: BUGTRAQ

Name: 20070303 rPSA-2007-0040-3 firefox thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/461809/100/0/threaded

External Source: BUGTRAQ

Name: 20070226 rPSA-2007-0040-1 firefox

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/461336/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0108

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0108.html

External Source: REDHAT

Name: RHSA-2007:0097

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0097.html

External Source: REDHAT

Name: RHSA-2007:0079

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0079.html

External Source: REDHAT

Name: RHSA-2007:0078

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0078.html

External Source: OSVDB

Name: 32105

Hyperlink:http://www.osvdb.org/32105

External Source: MANDRIVA

Name: MDKSA-2007:052

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:052

External Source: GENTOO

Name: GLSA-200703-22

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml

External Source: DEBIAN

Name: DSA-1336

Hyperlink:http://www.debian.org/security/2007/dsa-1336

External Source: SUNALERT

Name: 102856

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1

External Source: GENTOO

Name: GLSA-200703-18

Hyperlink:http://security.gentoo.org/glsa/glsa-200703-18.xml

External Source: SECUNIA

Name: 24703

Type: Advisory

Hyperlink:http://secunia.com/advisories/24703

External Source: SECUNIA

Name: 24650

Type: Advisory

Hyperlink:http://secunia.com/advisories/24650

External Source: SECUNIA

Name: 24562

Type: Advisory

Hyperlink:http://secunia.com/advisories/24562

External Source: SECUNIA

Name: 24522

Type: Advisory

Hyperlink:http://secunia.com/advisories/24522

External Source: SECUNIA

Name: 24410

Type: Advisory

Hyperlink:http://secunia.com/advisories/24410

External Source: SECUNIA

Name: 24395

Type: Advisory

Hyperlink:http://secunia.com/advisories/24395

External Source: SECUNIA

Name: 24389

Type: Advisory

Hyperlink:http://secunia.com/advisories/24389

External Source: SECUNIA

Name: 24384

Type: Advisory

Hyperlink:http://secunia.com/advisories/24384

External Source: SECUNIA

Name: 24343

Type: Advisory

Hyperlink:http://secunia.com/advisories/24343

External Source: SECUNIA

Name: 24333

Type: Advisory

Hyperlink:http://secunia.com/advisories/24333

External Source: SECUNIA

Name: 24328

Type: Advisory

Hyperlink:http://secunia.com/advisories/24328

External Source: SECUNIA

Name: 24320

Type: Advisory

Hyperlink:http://secunia.com/advisories/24320

External Source: SECUNIA

Name: 24293

Type: Advisory

Hyperlink:http://secunia.com/advisories/24293

External Source: SECUNIA

Name: 24290

Type: Advisory

Hyperlink:http://secunia.com/advisories/24290

External Source: SECUNIA

Name: 24287

Type: Advisory

Hyperlink:http://secunia.com/advisories/24287

External Source: SECUNIA

Name: 24277

Type: Advisory

Hyperlink:http://secunia.com/advisories/24277

External Source: SECUNIA

Name: 24253

Type: Advisory

Hyperlink:http://secunia.com/advisories/24253

External Source: SECUNIA

Name: 24252

Type: Advisory

Hyperlink:http://secunia.com/advisories/24252

External Source: SECUNIA

Name: 24238

Type: Advisory

Hyperlink:http://secunia.com/advisories/24238

External Source: SECUNIA

Name: 24205

Type: Advisory

Hyperlink:http://secunia.com/advisories/24205

External Source: REDHAT

Name: RHSA-2007:0077

Hyperlink:http://rhn.redhat.com/errata/RHSA-2007-0077.html

External Source: OVAL

Name: oval:org.mitre.oval:def:10502

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10502

External Source: SUSE

Name: SUSE-SA:2007:019

Hyperlink:http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

External Source: IDEFENSE

Name: 20070223 Mozilla Network Security Services SSLv2 Client Integer Underflow Vulnerability

Type: Advisory

Hyperlink:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482

External Source: HP

Name: HPSBUX02153

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: FEDORA

Name: FEDORA-2007-293

Hyperlink:http://fedoranews.org/cms/node/2728

External Source: FEDORA

Name: FEDORA-2007-281

Hyperlink:http://fedoranews.org/cms/node/2713

External Source: FEDORA

Name: FEDORA-2007-279

Hyperlink:http://fedoranews.org/cms/node/2711

External Source: FEDORA

Name: FEDORA-2007-278

Hyperlink:http://fedoranews.org/cms/node/2709

External Source: SGI

Name: 20070301-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc

External Source: SUSE

Name: SUSE-SA:2007:022

Hyperlink:http://www.novell.com/linux/security/advisories/2007_22_mozilla.html

External Source: MANDRIVA

Name: MDKSA-2007:050

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:050

External Source: SUNALERT

Name: 102945

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1

External Source: SLACKWARE

Name: SSA:2007-066-03

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

External Source: SLACKWARE

Name: SSA:2007-066-04

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947

External Source: SLACKWARE

Name: SSA:2007-066-05

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

External Source: SECUNIA

Name: 25597

Hyperlink:http://secunia.com/advisories/25597

External Source: SECUNIA

Name: 25588

Hyperlink:http://secunia.com/advisories/25588

External Source: SECUNIA

Name: 24457

Hyperlink:http://secunia.com/advisories/24457

External Source: SECUNIA

Name: 24456

Hyperlink:http://secunia.com/advisories/24456

External Source: SECUNIA

Name: 24455

Hyperlink:http://secunia.com/advisories/24455

External Source: SECUNIA

Name: 24406

Hyperlink:http://secunia.com/advisories/24406

External Source: SECUNIA

Name: 24342

Hyperlink:http://secunia.com/advisories/24342

External Source: HP

Name: HPSBUX02153

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: FEDORA

Name: FEDORA-2007-309

Hyperlink:http://fedoranews.org/cms/node/2749

External Source: FEDORA

Name: FEDORA-2007-308

Hyperlink:http://fedoranews.org/cms/node/2747

External Source: SGI

Name: 20070202-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc

References to Check Content

Identifier:oval:org.mitre.oval:def:10502

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10502