The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements :

  - Fix OpenSSL ciphers stopped parsing at +.
    (CVE-2016-3099)

  - Created valgrind suppression files to ease debugging.

  - Implement SSL_PPTYPE_FILTER to call executables to get     the key password pins.

  - Improvements to migrate.pl.

  - Update default ciphers to something more modern and     secure.

  - Check for host and netstat commands in gencert before     trying to use them.

  - Add server support for DHE ciphers.

  - Extract SAN from server/client certificates into env

  - Fix memory leaks and other coding issues caught by clang     analyzer.

  - Add support for Server Name Indication (SNI).

  - Add support for SNI for reverse proxy connections.

  - Add RenegBufferSize? option.

  - Add support for TLS Session Tickets (RFC 5077).

  - Fix logical AND support in OpenSSL cipher compatibility.

  - Correctly handle disabled ciphers. (CVE-2015-5244)

  - Implement a slew more OpenSSL cipher macros.

  - Fix a number of illegal memory accesses and memory     leaks.

  - Support for SHA384 ciphers if they are available in NSS.

  - Add compatibility for mod_ssl-style cipher definitions.

  - Add TLSv1.2-specific ciphers.

  - Completely remove support for SSLv2.

  - Add support for sqlite NSS databases.

  - Compare subject CN and VS hostname during server start     up.

  - Add support for enabling TLS v1.2.

  - Don't enable SSL 3 by default. (CVE-2014-3566)

  - Fix CVE-2013-4566.

  - Move nss_pcache to /usr/libexec.

  - Support httpd 2.4+.

  - SHA256 cipher names change spelling from *_sha256 to
    *_sha_256.

  - Use apache2-systemd-ask-pass to prompt for a certificate     passphrase. (bsc#972968, bsc#975394)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements :

  - Fix OpenSSL ciphers stopped parsing at +.
    (CVE-2016-3099)

  - Created valgrind suppression files to ease debugging.

  - Implement SSL_PPTYPE_FILTER to call executables to get     the key password pins.

  - Improvements to migrate.pl.

  - Update default ciphers to something more modern and     secure.

  - Check for host and netstat commands in gencert before     trying to use them.

  - Add server support for DHE ciphers.

  - Extract SAN from server/client certificates into env

  - Fix memory leaks and other coding issues caught by clang     analyzer.

  - Add support for Server Name Indication (SNI).

  - Add support for SNI for reverse proxy connections.

  - Add RenegBufferSize? option.

  - Add support for TLS Session Tickets (RFC 5077).

  - Fix logical AND support in OpenSSL cipher compatibility.

  - Correctly handle disabled ciphers. (CVE-2015-5244)

  - Implement a slew more OpenSSL cipher macros.

  - Fix a number of illegal memory accesses and memory     leaks.

  - Support for SHA384 ciphers if they are available in NSS.

  - Add compatibility for mod_ssl-style cipher definitions.

  - Add TLSv1.2-specific ciphers.

  - Completely remove support for SSLv2.

  - Add support for sqlite NSS databases.

  - Compare subject CN and VS hostname during server start     up.

  - Add support for enabling TLS v1.2.

  - Don't enable SSL 3 by default. (CVE-2014-3566)

  - Fix CVE-2013-4566.

  - Move nss_pcache to /usr/libexec.

  - Support httpd 2.4+.

  - Use apache2-systemd-ask-pass to prompt for a certificate     passphrase. (bsc#972968, bsc#975394)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2015-5244. An OpenSSL cipher string wasn't disabled when prefixed with !.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream 1.0.12 * Fixes CVE-2015-5244 * Add support for SNI
* Add RenegBufferSize option * Add support for TLS Session Tickets (RFC 5077) For full list of changes see https://fedorahosted.org/mod_nss/wiki/Releases mod_nss-1.0.12-1.fc23 - Update to upstream 1.0.12

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that the parsing of the NSSCipherSuite option of mod24_nss, which accepts OpenSSL-style cipherstrings, is flawed. If the option is used to disable insecure ciphersuites using the common '!' syntax, it will actually enable those insecure ciphersuites.
(CVE-2015-5244)

ID	Name	Product	Family	Severity
93767	SUSE SLES12 Security Update : apache2-mod_nss (SUSE-SU-2016:2396-1) (POODLE)	Nessus	SuSE Local Security Checks	critical
93457	SUSE SLES12 Security Update : apache2-mod_nss (SUSE-SU-2016:2285-1) (POODLE)	Nessus	SuSE Local Security Checks	critical
89562	Fedora 22 : mod_nss-1.0.11-6.fc22 (2016-6aa4dd4f3a)	Nessus	Fedora Local Security Checks	critical
89402	Fedora 23 : mod_nss-1.0.12-1.fc23 (2015-c76c1c84cf)	Nessus	Fedora Local Security Checks	critical
88662	Amazon Linux AMI : mod24_nss (ALAS-2016-650)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2015-5244

critical

Tenable Plugins

critical

critical

critical

critical

critical