mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - mod_nss: Invalid handling of +CIPHER operator (CVE-2016-3099)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - mod_nss: Invalid handling of +CIPHER operator (CVE-2016-3099)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the mod_nss package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way mod_nss parsed certain     OpenSSL-style cipher strings. As a result, mod_nss     could potentially use ciphers that were not intended to     be enabled. (CVE-2016-3099)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a newer upstream version:
mod_nss (1.0.14).

Security Fix(es) :

  - A flaw was found in the way mod_nss parsed certain     OpenSSL-style cipher strings. As a result, mod_nss could     potentially use ciphers that were not intended to be     enabled. (CVE-2016-3099)

This issue was discovered by Rob Crittenden (Red Hat).

Additional Changes :

An update for mod_nss is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The mod_nss module provides strong cryptography for the Apache HTTP Server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, using the Network Security Services (NSS) security library.

The following packages have been upgraded to a newer upstream version:
mod_nss (1.0.14). (BZ#1299063)

Security Fix(es) :

* A flaw was found in the way mod_nss parsed certain OpenSSL-style cipher strings. As a result, mod_nss could potentially use ciphers that were not intended to be enabled. (CVE-2016-3099)

This issue was discovered by Rob Crittenden (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-2602 advisory.

    - OpenSSL ciphers stopped parsing at +, CVE-2016-3099 (#1323913)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements :

  - Fix OpenSSL ciphers stopped parsing at +.
    (CVE-2016-3099)

  - Created valgrind suppression files to ease debugging.

  - Implement SSL_PPTYPE_FILTER to call executables to get     the key password pins.

  - Improvements to migrate.pl.

  - Update default ciphers to something more modern and     secure.

  - Check for host and netstat commands in gencert before     trying to use them.

  - Add server support for DHE ciphers.

  - Extract SAN from server/client certificates into env

  - Fix memory leaks and other coding issues caught by clang     analyzer.

  - Add support for Server Name Indication (SNI).

  - Add support for SNI for reverse proxy connections.

  - Add RenegBufferSize? option.

  - Add support for TLS Session Tickets (RFC 5077).

  - Fix logical AND support in OpenSSL cipher compatibility.

  - Correctly handle disabled ciphers. (CVE-2015-5244)

  - Implement a slew more OpenSSL cipher macros.

  - Fix a number of illegal memory accesses and memory     leaks.

  - Support for SHA384 ciphers if they are available in NSS.

  - Add compatibility for mod_ssl-style cipher definitions.

  - Add TLSv1.2-specific ciphers.

  - Completely remove support for SSLv2.

  - Add support for sqlite NSS databases.

  - Compare subject CN and VS hostname during server start     up.

  - Add support for enabling TLS v1.2.

  - Don't enable SSL 3 by default. (CVE-2014-3566)

  - Fix CVE-2013-4566.

  - Move nss_pcache to /usr/libexec.

  - Support httpd 2.4+.

  - SHA256 cipher names change spelling from *_sha256 to
    *_sha_256.

  - Use apache2-systemd-ask-pass to prompt for a certificate     passphrase. (bsc#972968, bsc#975394)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements :

  - Fix OpenSSL ciphers stopped parsing at +.
    (CVE-2016-3099)

  - Created valgrind suppression files to ease debugging.

  - Implement SSL_PPTYPE_FILTER to call executables to get     the key password pins.

  - Improvements to migrate.pl.

  - Update default ciphers to something more modern and     secure.

  - Check for host and netstat commands in gencert before     trying to use them.

  - Add server support for DHE ciphers.

  - Extract SAN from server/client certificates into env

  - Fix memory leaks and other coding issues caught by clang     analyzer.

  - Add support for Server Name Indication (SNI).

  - Add support for SNI for reverse proxy connections.

  - Add RenegBufferSize? option.

  - Add support for TLS Session Tickets (RFC 5077).

  - Fix logical AND support in OpenSSL cipher compatibility.

  - Correctly handle disabled ciphers. (CVE-2015-5244)

  - Implement a slew more OpenSSL cipher macros.

  - Fix a number of illegal memory accesses and memory     leaks.

  - Support for SHA384 ciphers if they are available in NSS.

  - Add compatibility for mod_ssl-style cipher definitions.

  - Add TLSv1.2-specific ciphers.

  - Completely remove support for SSLv2.

  - Add support for sqlite NSS databases.

  - Compare subject CN and VS hostname during server start     up.

  - Add support for enabling TLS v1.2.

  - Don't enable SSL 3 by default. (CVE-2014-3566)

  - Fix CVE-2013-4566.

  - Move nss_pcache to /usr/libexec.

  - Support httpd 2.4+.

  - Use apache2-systemd-ask-pass to prompt for a certificate     passphrase. (bsc#972968, bsc#975394)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was reported that +CIPHER operator in OpenSSL changes the order of a cipher. Instead of returning an error (as NSS does not support cipher ordering), it returned the result of processing up to that point, which could result in requested ciphers not being enabled.

Security fix for CVE-2016-3099

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199593	RHEL 6 : mod_nss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199559	RHEL 5 : mod_nss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
99832	EulerOS 2.0 SP1 : mod_nss (EulerOS-SA-2016-1070)	Nessus	Huawei Local Security Checks	high
95848	Scientific Linux Security Update : mod_nss on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	high
95348	CentOS 7 : mod_nss (CESA-2016:2602)	Nessus	CentOS Local Security Checks	high
94721	Oracle Linux 7 : mod_nss (ELSA-2016-2602)	Nessus	Oracle Linux Local Security Checks	high
94565	RHEL 7 : mod_nss (RHSA-2016:2602)	Nessus	Red Hat Local Security Checks	high
93767	SUSE SLES12 Security Update : apache2-mod_nss (SUSE-SU-2016:2396-1) (POODLE)	Nessus	SuSE Local Security Checks	critical
93457	SUSE SLES12 Security Update : apache2-mod_nss (SUSE-SU-2016:2285-1) (POODLE)	Nessus	SuSE Local Security Checks	critical
91628	Amazon Linux AMI : mod24_nss (ALAS-2016-714)	Nessus	Amazon Linux Local Security Checks	high
90951	Fedora 24 : mod_nss-1.0.12-4.fc24 (2016-1eaaf1ed0f)	Nessus	Fedora Local Security Checks	high
90734	Fedora 23 : mod_nss-1.0.12-3.fc23 (2016-8b28358b72)	Nessus	Fedora Local Security Checks	high
90733	Fedora 22 : mod_nss-1.0.11-7.fc22 (2016-85e9f2e3cd)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-3099

high

Tenable Plugins

high

high

high

high

high

high

high

critical

critical

high

high

high

high