The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1090 advisory.

    Network Security Services (NSS) is a set of libraries designed to support     the cross-platform development of security-enabled client and server     applications. Netscape Portable Runtime (NSPR) provides platform     independence for non-GUI operating system facilities.

    A flaw was found in the way the ASN.1 (Abstract Syntax Notation One)     decoder in NSS handled zero length items. This flaw could cause the decoder     to incorrectly skip or replace certain items with a default value, or could     cause an application to crash if, for example, it received a     specially-crafted OCSP (Online Certificate Status Protocol) response.
    (CVE-2012-0441)

    It was found that a Certificate Authority (CA) issued a subordinate CA     certificate to its customer, that could be used to issue certificates for     any name. This update renders the subordinate CA certificate as untrusted.
    (BZ#798533)

    Note: The BZ#798533 fix only applies to applications using the NSS Builtin     Object Token. It does not render the certificates untrusted for     applications that use the NSS library, but do not use the NSS Builtin     Object Token.

    In addition, the nspr package has been upgraded to upstream version 4.9.1,     and the nss package has been upgraded to upstream version 3.13.5. These     updates provide a number of bug fixes and enhancements over the previous     versions. (BZ#834220, BZ#834219)

    All NSS and NSPR users should upgrade to these updated packages, which     correct these issues and add these enhancements. After installing the     update, applications using NSS and NSPR must be restarted for the changes     to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 : nss and nspr (RHSA-2012:1090)

high Nessus Plugin ID 60010

Version 1.24