Critical Netscape Flaw Found

KingFishKingFish
edited August 2004 in Science & Tech
Security company Internet Security Systems is warning its customers about a critical security hole in a commonly used technology from the Mozilla Foundation called the Netscape Network Security Services (NSS) library that could make Web servers vulnerable to remote attack.
ISS issued a security bulletin this week about a flaw in the NSS library's implementation of the Secure Sockets Layer Version 2 (SSLv2) protocol that could allow remote attackers to use an SSLv2 connection to take control of Web servers using the NSS library. The flaw in the NSS library affects the Netscape Enterprise Server and Sun Microsystems' Sun Java System Web Server, but may also affect countless other products that use the open source NSS library, ISS says. The problem stems from a flaw in the way the NSS library handles requests for new SSLv2 sessions. Servers using the NSS library do not check the length of a record field in the first part of the negotiation between two systems attempting to establish an SSLv2 session. Malicious hackers could use the absence of that length check in the first record sent in the negotiation, known as the "hello message," to cause a heap overflow, allowing them to place and run malicious code on a vulnerable server, ISS says.
Source: PCWorld

Comments

Sign In or Register to comment.