Description
The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html ↗
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html ↗
- https://developer.mozilla.org/docs/NSS/NSS_3.15.4_release_notes ↗
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html ↗
- http://www.securityfocus.com/bid/64944 ↗
- http://www.securityfocus.com/archive/1/534161/100/0/threaded ↗
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90394 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1053725 ↗
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html ↗
- http://seclists.org/fulldisclosure/2014/Dec/23 ↗
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html ↗
- http://www.ubuntu.com/usn/USN-2088-1 ↗
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html ↗
- https://bugzilla.mozilla.org/show_bug.cgi?id=919877 ↗
- https://bugs.gentoo.org/show_bug.cgi?id=498172 ↗