Back to search
CVE-2014-1569
Published: Dec 15, 2014
Modified: Aug 6, 2024
PUBLISHED
Description
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1064670
x_refsource_CONFIRM
openSUSE-SU-2015:0138
vendor-advisory
x_refsource_SUSE
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
x_refsource_CONFIRM
1032909
vdb-entry
x_refsource_SECTRACK
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
x_refsource_CONFIRM
SUSE-SU-2015:0173
vendor-advisory
x_refsource_SUSE
SUSE-SU-2015:0171
vendor-advisory
x_refsource_SUSE
https://www.imperialviolet.org/2014/09/26/pkcs1.html
x_refsource_MISC
openSUSE-SU-2015:0404
vendor-advisory
x_refsource_SUSE
DSA-3186
vendor-advisory
x_refsource_DEBIAN
SUSE-SU-2015:0180
vendor-advisory
x_refsource_SUSE
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now