Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)

critical Nessus Plugin ID 142720

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1559 advisory.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
(CVE-2019-11719)

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68. (CVE-2019-11727)

A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS. (CVE-2019-11756)

A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak.
The highest threat is to confidentiality and integrity of data as well as system availability.
(CVE-2019-17006)

A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. (CVE-2019-17023)

A side channel flaw was found in nss, in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-12400)

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-12401)

A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks.
An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality. (CVE-2020-12402)

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability. (CVE-2020-12403)

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-6829)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update nspr' to update your system.
Run 'yum update nss-softokn' to update your system.
Run 'yum update nss-util' to update your system.
Run 'yum update nss' to update your system.

Plugin Details

Severity: Critical

ID: 142720

File Name: al2_ALAS-2020-1559.nasl

Version: 1.4

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 11/11/2020

Updated: 12/11/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-17006

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:nspr-devel, p-cpe:/a:amazon:linux:nss-softokn, p-cpe:/a:amazon:linux:nss-util-devel, p-cpe:/a:amazon:linux:nss-util, p-cpe:/a:amazon:linux:nss-devel, p-cpe:/a:amazon:linux:nss-softokn-devel, p-cpe:/a:amazon:linux:nss-softokn-freebl, p-cpe:/a:amazon:linux:nss, p-cpe:/a:amazon:linux:nss-softokn-freebl-devel, p-cpe:/a:amazon:linux:nss-sysinit, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:nss-pkcs11-devel, p-cpe:/a:amazon:linux:nss-tools, p-cpe:/a:amazon:linux:nss-util-debuginfo, p-cpe:/a:amazon:linux:nspr, p-cpe:/a:amazon:linux:nss-debuginfo, p-cpe:/a:amazon:linux:nspr-debuginfo, p-cpe:/a:amazon:linux:nss-softokn-debuginfo

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/9/2020

Vulnerability Publication Date: 7/9/2019

Reference Information

CVE: CVE-2019-11719, CVE-2019-11727, CVE-2019-11756, CVE-2019-17006, CVE-2019-17023, CVE-2020-12400, CVE-2020-12401, CVE-2020-12402, CVE-2020-12403, CVE-2020-6829

BID: 109086, 109085

ALAS: 2020-1559

Detections

Analytics