CVE-2014-1492 in Mozilla Network Security Services

Сводка (Английский)

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name s U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

Резервировать

16.01.2014

Раскрытие

25.03.2014

Записи

VulDB provides additional information and datapoints for this CVE:

ИД	Уязвимость	CWE	Экс	Кон	CVE
12685	Mozilla Network Security Services p12creat.c sec_pkcs12_new_asafe эскалация привилегий	20	недоказанный	Официальное исправление	CVE-2014-1492
12684	Mozilla Network Security Services Domain Name эскалация привилегий	20	недоказанный	Официальное исправление	CVE-2014-1492