CVE-2009-2404
Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 4.15% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- mozilla/network security services
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2009-1185.html
- http://secunia.com/advisories/36088Vendor Advisory
- http://secunia.com/advisories/36102Vendor Advisory
- http://secunia.com/advisories/36125Vendor Advisory
- http://secunia.com/advisories/36139Vendor Advisory
- http://secunia.com/advisories/36157Vendor Advisory
- http://secunia.com/advisories/36434
- http://secunia.com/advisories/37098
- http://secunia.com/advisories/39428
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-273910-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021030.1-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021699.1-1
- http://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf
- http://www.debian.org/security/2009/dsa-1874
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:197
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:216
- http://www.mozilla.org/security/announce/2009/mfsa2009-43.htmlPatch, Vendor Advisory
- http://www.novell.com/linux/security/advisories/2009_48_firefox.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2010-099504.html
- http://www.redhat.com/support/errata/RHSA-2009-1207.html
- http://www.securityfocus.com/bid/35891Patch
- http://www.ubuntu.com/usn/usn-810-1
- http://www.us-cert.gov/cas/techalerts/TA10-103B.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/2085Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=512912
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11174
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8658
- https://usn.ubuntu.com/810-2/
- http://rhn.redhat.com/errata/RHSA-2009-1185.html
- http://secunia.com/advisories/36088Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.