You are currently viewing a snapshot of www.mozilla.org taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to www.mozilla.org, please file a bug.

Skip to main content

You are here: Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.2) > MFSA 2007-06

Mozilla Foundation Security Advisory 2007-06

Title: Mozilla Network Security Services (NSS) SSLv2 buffer overflows
Impact: Critical (Firefox 2.0 not affected in default configuration)
Announced: February 23, 2007
Reporter: iDefense
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 2.0.0.2
  Firefox 1.5.0.10
  Thunderbird 1.5.0.10
  SeaMonkey 1.0.8
  NSS 3.11.5

Description

iDefense has informed Mozilla about two potential buffer overflow vulnerabilities found by researcher regenrecht in the Network Security Services (NSS) code for processing the SSLv2 protocol.

SSL clients such as Firefox and Thunderbird can suffer a buffer overflow if a malicious server presents a certificate with a public key that is too small to encrypt the entire "Master Secret". Exploiting this overflow appears to be unreliable but possible if the SSLv2 protocol is enabled.

Servers that use NSS for the SSLv2 protocol can be exploited by a client that presents a "Client Master Key" with invalid length values in any of several fields that are used without adequate error checking. This can lead to a buffer overflow that presumably could be exploitable.

Support for SSLv2 is disabled in Firefox 2 due to other known weaknesses in the protocol; Firefox 2 is not vulnerable unless the user has modified hidden internal NSS settings to re-enable SSLv2 support.

Workaround

Disable the SSLv2 protocol in any product that has not already done so.

In Firefox 1.5:
Click on the Advanced icon in the Options/Preferences dialog.
On the Security tab uncheck the box next to "Use SSL 2.0"
click the "OK" button.

In Thunderbird 1.5:
Click on the Advanced icon in the Options/Preferences dialog.
Click the "Config Editor..." button.
Type ssl2 in the Filter field
Double-click security.enable_ssl2 to change the value to false and close the window.

Server products making use of NSS should also disable the SSLv2 protocol.

Products using the NSS libraries should upgrade to version 3.11.5

References