Null Pointer Dereference Vulnerability in nss
Summary
DLA-971-1: nss - security update. Affects nss versions < 2:3.26-1+debu7u4. Fixed in 2:3.26-1+debu7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NSS (Network Security Services) is a set of libraries designed to support the development of security-enabled client and server applications. It provides a complete open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. The vulnerability affects the nss package in Debian 7 Wheezy.
Vulnerability Detail
A null pointer dereference vulnerability was discovered in NSS when a server receives empty SSLv2 messages. This vulnerability was introduced in version 3.24.0 of NSS when the SSLv2 protocol was removed and a dedicated parser for sslv2-style hello messages was added. The vulnerability could allow an attacker to crash the server by sending specially crafted empty SSLv2 messages.
How To Fix
Minimum fixed version
2:3.26-1+debu7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, a null pointer dereference vulnerability was discovered in the nss package, which could allow an attacker to crash the server by sending specially crafted empty SSLv2 messages. It is recommended to upgrade the nss package to version 2:3.26-1+debu7u4 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
NSS (Network Security Services) is a set of libraries designed to support the development of security-enabled client and server applications. It provides a complete open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.
A null pointer dereference vulnerability occurs when a program attempts to access or dereference a null pointer, resulting in a crash or potentially exploitable behavior.
The vulnerability in nss could allow an attacker to crash the server by sending specially crafted empty SSLv2 messages.
No, there is no known workaround for this vulnerability.
To fix this vulnerability, it is recommended to upgrade the nss package to version 2:3.26-1+debu7u4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
