Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.0993
New NSS packages fix cryptographic weaknesses
2 November 2010
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: nss
Publisher: Debian
Operating System: Debian GNU/Linux 5
Impact/Access: Provide Misleading Information -- Remote with User Interaction
Reduced Security -- Remote/Unauthenticated
Unauthorised Access -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2010-3173 CVE-2010-3170
Reference: ASB-2010.0229
ESB-2010.0945
ESB-2010.0943
Original Bulletin:
http://www.debian.org/security/2010/dsa-2123
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ------------------------------------------------------------------------
Debian Security Advisory DSA-2123-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
November 01, 2010 http://www.debian.org/security/faq
- - ------------------------------------------------------------------------
Package : nss
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-3170 CVE-2010-3173
Several vulnerabilities have been discovered in Mozilla's Network
Security Services (NSS) library. The Common Vulnerabilities and
Exposures project identifies the following problems:
CVE-2010-3170
NSS recognizes a wildcard IP address in the subject's Common
Name field of an X.509 certificate, which might allow
man-in-the-middle attackers to spoof arbitrary SSL servers via
a crafted certificate issued by a legitimate Certification
Authority.
CVE-2010-3173
NSS does not properly set the minimum key length for
Diffie-Hellman Ephemeral (DHE) mode, which makes it easier for
remote attackers to defeat cryptographic protection mechanisms
via a brute-force attack.
For the stable distribution (lenny), these problems have been fixed in
version 3.12.3.1-0lenny2.
For the unstable distribution (sid) and the upcoming stable
distribution (squeeze), these problems have been fixed in version
3.12.8-1.
We recommend that you upgrade your NSS packages.
Upgrade instructions
- - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 5.0 alias lenny
- - --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.dsc
Size/MD5 checksum: 1394 908a5e77c32e84069883a3cfb836eb24
http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.diff.gz
Size/MD5 checksum: 53696 3d064b2d08ccc6a8ae11e1771379f1c7
http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1.orig.tar.gz
Size/MD5 checksum: 5320607 750839c9c018a0984fd94f7a9cc3dd7f
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_alpha.deb
Size/MD5 checksum: 273438 6a97ce0db5683e1b87c2a3debd4f0a2f
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_alpha.deb
Size/MD5 checksum: 3049536 4eaec5fabcab56b1fe06c2d6e0fa8574
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_alpha.deb
Size/MD5 checksum: 342354 6bb6d7334e986265f9a1f6f0d6778d98
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_alpha.deb
Size/MD5 checksum: 1207870 d84910b4354cdb1796dd3d5787cdcee8
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_amd64.deb
Size/MD5 checksum: 3101238 6350cb985ded4fbc6fb4c65127f586da
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_amd64.deb
Size/MD5 checksum: 320840 7cc70e973254a99a76834a7febbadc67
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_amd64.deb
Size/MD5 checksum: 1071354 1fb1921a73e16bfd2a4dc6925bdb8a7e
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_amd64.deb
Size/MD5 checksum: 262634 799e5eb80cf076fe34c9643b8078bb43
arm architecture (ARM)
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_arm.deb
Size/MD5 checksum: 254618 0d553164d3d303e096efbac3ab2dcabe
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_arm.deb
Size/MD5 checksum: 309000 edc68fa74a8b939293ca23f7aa3a6efd
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_arm.deb
Size/MD5 checksum: 1011704 9b9e1459b833922e31510cefab0594c0
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_arm.deb
Size/MD5 checksum: 2901632 4ad15a531cdf51ef146f3337148a71d2
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_armel.deb
Size/MD5 checksum: 2924760 f06d340c4aa9f4044d5a00df6617e624
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_armel.deb
Size/MD5 checksum: 1017348 3f72c2cb4d1d39d0fed98acd9d4409c3
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_armel.deb
Size/MD5 checksum: 308638 f81fb9ba70eb3e5b8f3117dba5c18a6b
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_armel.deb
Size/MD5 checksum: 258562 2b0b270a34ce0bfa9b8d7589782a820d
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_hppa.deb
Size/MD5 checksum: 262180 5bb31fdc16b4883f42f3d9a8db31b478
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_hppa.deb
Size/MD5 checksum: 347268 025014303d4e266c8b3e7260022624e7
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_hppa.deb
Size/MD5 checksum: 2946180 aff9d6ce1e1fefe47443116d9791eee7
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_hppa.deb
Size/MD5 checksum: 1169546 e439f85cb7d5755488283b48c25213bc
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_i386.deb
Size/MD5 checksum: 303718 a9bdcd4d31a594c196f18b916adcf29c
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_i386.deb
Size/MD5 checksum: 259032 77d7d235c8395b14c47033158ca99a12
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_i386.deb
Size/MD5 checksum: 2915646 fdf2b28a0b482e9b5310a69e303162a9
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_i386.deb
Size/MD5 checksum: 958778 233e968682a24b1f7b8259552d869cc9
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_ia64.deb
Size/MD5 checksum: 272290 c833704551b7330ff002c7a486fd6326
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_ia64.deb
Size/MD5 checksum: 410084 393d05ececb2b56c3e9cf8667bee6e37
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_ia64.deb
Size/MD5 checksum: 1489784 30b154c46b4d3609a54f86bd2c9608d4
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_ia64.deb
Size/MD5 checksum: 2800250 411058093b4bcf9cc241c97283b706f4
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_mips.deb
Size/MD5 checksum: 1039604 93dce812de2605a1decf3a91cf1fdcb6
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mips.deb
Size/MD5 checksum: 3050894 433d8ac69c75486c3f4ef1a8e8b571fc
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_mips.deb
Size/MD5 checksum: 262606 24bc492fd4fb188222ce9eeb1ff0c768
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mips.deb
Size/MD5 checksum: 319884 a9f8a2f8b13d1bbd64ca5be52fafcdec
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_mipsel.deb
Size/MD5 checksum: 1028620 5373a76615b1208a0bcf648e1ac4d74d
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mipsel.deb
Size/MD5 checksum: 317226 528869d14dd652a8ff77a8d0949060ed
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_mipsel.deb
Size/MD5 checksum: 257912 d4f5d5704b0137797635350ee6dbd74d
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mipsel.deb
Size/MD5 checksum: 3001244 09ffd9355ea180446462c4762118c0ea
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_powerpc.deb
Size/MD5 checksum: 2948604 3378206f900751ead42c264fb889ded9
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_powerpc.deb
Size/MD5 checksum: 333556 11a62eebda4b15f09bc9923c0256d4b5
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_powerpc.deb
Size/MD5 checksum: 1031552 66e7ef314e0003a4626be23fdf7843f6
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_powerpc.deb
Size/MD5 checksum: 259498 af3924c5043f456484598d76d6a0ca1f
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_s390.deb
Size/MD5 checksum: 263080 0675ec6c2daf678d558f529eb59c45e9
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_s390.deb
Size/MD5 checksum: 346292 1e77acadf630955325ad21d802512b39
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_s390.deb
Size/MD5 checksum: 3021080 a59b06101c7d226f6ca526164f92c5c7
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_s390.deb
Size/MD5 checksum: 1178440 a383e9a1ba4a2a8e1d8662031f2b7b0f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_sparc.deb
Size/MD5 checksum: 2713414 9fb579cb2a9729a7daa00472e4886c94
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_sparc.deb
Size/MD5 checksum: 257226 32f907739b4b8712832ab3370616a6af
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_sparc.deb
Size/MD5 checksum: 997232 2803a67dba4eff8dff851f89a5363592
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_sparc.deb
Size/MD5 checksum: 317520 32e167507b034ffc02a5371f46c968ea
These files will probably be moved into the stable distribution on
its next update.
- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iQEbBAEBAgAGBQJMzxtXAAoJEL97/wQC1SS+8pkH93UBE2a/EaNub2xLT3G4K8Ga
ZlEldfLkl6IvdS74gIt3H4fvIOMkRbw9FZZgEhGGLoMvYD45RIkDWxp4bTm4GhIr
uDk5W1qsodHEYGWGOvKRE+WqOVWWTa43v2aGfqfSHBoC1tNnaHFiR9AZWmpVfWC4
PhXbhWwRO12fxxVvpgb+JS8fZd/i2ztmXC5zoruZEgwODW9+MFptWf5hUVnr5/y0
dJuJiSXktCqP3I1SSY10D2KUBgAIJ2rjTx4nwZvD+7BPRQgBtwH1Vx7kRa6dlxSp
zsVxpRYTA57RzQmvGrVkoxdwvrYhB0T8eBDkp2woR5ScLdhemtcbeiJYpTEjqA==
=rBQ3
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFMz27T/iFOrG6YcBERAtYpAKCVC7Nf303ENzpgNK7KSPlkD4IB6QCggJ2T
iGSGtWGY9DEKfGCwgV+QJ+g=
=dYVC
-----END PGP SIGNATURE-----