CVE-2013-1740

Published: Jan 18, 2014Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.

Affected (47)

Products: Mozilla: Network Security Services

1 product

Network Security Services

Configuration A

47 vulnerable

Vulnerable Software	Affected Versions
Mozilla Network Security Services	Up to 3.15.3
Mozilla Network Security Services	Version 3.11.2
Mozilla Network Security Services	Version 3.11.3
Mozilla Network Security Services	Version 3.11.4
Mozilla Network Security Services	Version 3.11.5
Mozilla Network Security Services	Version 3.12.10
Mozilla Network Security Services	Version 3.12.11
Mozilla Network Security Services	Version 3.12.1
Mozilla Network Security Services	Version 3.12.2
Mozilla Network Security Services	Version 3.12.3.1
Mozilla Network Security Services	Version 3.12.3.2
Mozilla Network Security Services	Version 3.12.3
Mozilla Network Security Services	Version 3.12.4
Mozilla Network Security Services	Version 3.12.5
Mozilla Network Security Services	Version 3.12.6
Mozilla Network Security Services	Version 3.12.7
Mozilla Network Security Services	Version 3.12.8
Mozilla Network Security Services	Version 3.12.9
Mozilla Network Security Services	Version 3.12
Mozilla Network Security Services	Version 3.14.1
Mozilla Network Security Services	Version 3.14.2
Mozilla Network Security Services	Version 3.14.3
Mozilla Network Security Services	Version 3.14.4
Mozilla Network Security Services	Version 3.14.5
Mozilla Network Security Services	Version 3.14
Mozilla Network Security Services	Version 3.15.1
Mozilla Network Security Services	Version 3.15.2
Mozilla Network Security Services	Version 3.15
Mozilla Network Security Services	Version 3.2.1
Mozilla Network Security Services	Version 3.2
Mozilla Network Security Services	Version 3.3.1
Mozilla Network Security Services	Version 3.3.2
Mozilla Network Security Services	Version 3.3
Mozilla Network Security Services	Version 3.4.1
Mozilla Network Security Services	Version 3.4.2
Mozilla Network Security Services	Version 3.4
Mozilla Network Security Services	Version 3.5
Mozilla Network Security Services	Version 3.6.1
Mozilla Network Security Services	Version 3.6
Mozilla Network Security Services	Version 3.7.1
Mozilla Network Security Services	Version 3.7.2
Mozilla Network Security Services	Version 3.7.3
Mozilla Network Security Services	Version 3.7.5
Mozilla Network Security Services	Version 3.7.7
Mozilla Network Security Services	Version 3.7
Mozilla Network Security Services	Version 3.8
Mozilla Network Security Services	Version 3.9

Related CWEs

References (34)

http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html

Source: security@mozilla.org

http://seclists.org/fulldisclosure/2014/Dec/23

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: security@mozilla.org

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: security@mozilla.org

http://www.securityfocus.com/bid/64944

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2088-1

Source: security@mozilla.org

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: security@mozilla.org

https://bugs.gentoo.org/show_bug.cgi?id=498172

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=919877

Source: security@mozilla.org

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=1053725

Source: security@mozilla.org

https://developer.mozilla.org/docs/NSS/NSS_3.15.4_release_notes

Source: security@mozilla.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/90394

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2014/Dec/23

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/64944

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2088-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.gentoo.org/show_bug.cgi?id=498172

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=919877

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=1053725

Source: af854a3a-2127-422b-91ae-364da2661108

https://developer.mozilla.org/docs/NSS/NSS_3.15.4_release_notes

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/90394

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.