A vulnerability in the certificate-checking implementation in Mozilla's Network Security Services (NSS) has been identified and attributed to Common Vulnerabilities and Exposures (CVE) as CVE-2014-1492. The vulnerability stems from the cert_TestHostName function in lib/certdb/certdb.c in the NSS. This post will provide information and discuss details of this vulnerability, its related code snippet, and potential exploits.

Vulnerability Details

The cert_TestHostName function in NSS is designed to accept wildcard characters which, when embedded in an internationalized domain name’s U-label, allow man-in-the-middle (MITM) attackers to potentially spoof SSL servers using a carefully crafted certificate. Specifically, the vulnerability exists in NSS versions prior to 3.16.

Original References

Mozilla Security Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2014-36/

Mozilla NSS Bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=860864

Code Snippet

The vulnerability exists within the cert_TestHostName function, which allows for verification of hostnames against a certificate’s Common Name or Subject Alternative Name extension of the form “*.domain.com.” In the affected versions of NSS, the function accepts a wildcard character embedded in an internationalized domain.

SECStatus
cert_TestHostName(char * cn, char * hName, int hNameLen)
{
...
 while (*hName) {
 if (!PORT_Strncasecmp(hName, ".xn--", 4)) {
 dName = PORT_Strrchr(hName, '.'); /* look for next (higher) level */
...
 }
...
}

Exploit Details

By exploiting this vulnerability, an attacker who has the ability to intercept the communication between the client and server can perform an MITM attack, effectively allowing them to spoof SSL servers using a carefully crafted certificate that allows a wildcard character embedded in an internationalized domain name’s U-label. This allows them to manipulate data received by the client, thereby resulting in significant security risks, such as sniffing sensitive data or tampering with transmitted information.

Mitigation

To mitigate the risks associated with this vulnerability, it is critical that users update their NSS libraries to version 3.16 or later. This update prevents any wildcard character embedded in internationalized domain names from being accepted, effectively closing the vulnerability that could lead to MITM attacks.

We strongly recommend users and developers using the NSS library to apply the recommended updates from Mozilla immediately. Any delay in doing so could result in significant security risks and exposure to potential attacks.

Conclusion

Keeping software up-to-date is a vital part of ensuring your online security. CVE-2014-1492 serves as an important reminder of the potential risks associated with running older, unpatched software. By updating your NSS installations and following recommended mitigation steps, you can help protect your SSL servers from dangerous MITM attacks and improve the overall security of your data and online presence.

Timeline

Published on: 03/25/2014 01:00:00 UTC
Last modified on: 10/09/2018 18:57:01 UTC