NSS up to 3.29 SessionTicket Extension session fixiation

Summaryinfo

A vulnerability was found in NSS up to 3.29. It has been classified as problematic. This affects an unknown part of the component SessionTicket Extension. Performing a manipulation results in session fixiation. This vulnerability is cataloged as CVE-2016-9574. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in NSS up to 3.29. This affects an unknown code block of the component SessionTicket Extension. The manipulation with an unknown input leads to a session fixiation vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on availability. The summary by CVE is:

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

The bug was discovered 12/14/2016. The weakness was shared 07/19/2018 as Bug 1320695 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.mozilla.org. This vulnerability is uniquely identified as CVE-2016-9574 since 11/23/2016. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 128 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 99618 (openSUSE Security Update : mozilla-nss (openSUSE-2017-504)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 169965 (SUSE Enterprise Linux Security Update for MozillaFirefox, mozilla-nss, mozilla-nspr (SUSE-SU-2017:1175-1)).

Upgrading to version 3.30 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (99618). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• NSS

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion