[IT-SecurityNotifies] [SECURITY] [DSA 2123-1] New NSS packages fix cryptographic weaknesses

[Florian Weimer <fw AT deneb.enyo.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2123-1                  security AT debian.org
http://www.debian.org/security/                           Florian Weimer
November 01, 2010                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : nss
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2010-3170 CVE-2010-3173

Several vulnerabilities have been discovered in Mozilla's Network
Security Services (NSS) library.  The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2010-3170
        NSS recognizes a wildcard IP address in the subject's Common
        Name field of an X.509 certificate, which might allow
        man-in-the-middle attackers to spoof arbitrary SSL servers via
        a crafted certificate issued by a legitimate Certification
        Authority.

CVE-2010-3173
        NSS does not properly set the minimum key length for
        Diffie-Hellman Ephemeral (DHE) mode, which makes it easier for
        remote attackers to defeat cryptographic protection mechanisms
        via a brute-force attack.

For the stable distribution (lenny), these problems have been fixed in
version 3.12.3.1-0lenny2.

For the unstable distribution (sid) and the upcoming stable
distribution (squeeze), these problems have been fixed in version
3.12.8-1.

We recommend that you upgrade your NSS packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

  http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.dsc
    Size/MD5 checksum:     1394 908a5e77c32e84069883a3cfb836eb24
  
http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1-0lenny2.diff.gz
    Size/MD5 checksum:    53696 3d064b2d08ccc6a8ae11e1771379f1c7
  http://security.debian.org/pool/updates/main/n/nss/nss_3.12.3.1.orig.tar.gz
    Size/MD5 checksum:  5320607 750839c9c018a0984fd94f7a9cc3dd7f

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_alpha.deb
    Size/MD5 checksum:   273438 6a97ce0db5683e1b87c2a3debd4f0a2f
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_alpha.deb
    Size/MD5 checksum:  3049536 4eaec5fabcab56b1fe06c2d6e0fa8574
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_alpha.deb
    Size/MD5 checksum:   342354 6bb6d7334e986265f9a1f6f0d6778d98
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_alpha.deb
    Size/MD5 checksum:  1207870 d84910b4354cdb1796dd3d5787cdcee8

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_amd64.deb
    Size/MD5 checksum:  3101238 6350cb985ded4fbc6fb4c65127f586da
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_amd64.deb
    Size/MD5 checksum:   320840 7cc70e973254a99a76834a7febbadc67
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_amd64.deb
    Size/MD5 checksum:  1071354 1fb1921a73e16bfd2a4dc6925bdb8a7e
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_amd64.deb
    Size/MD5 checksum:   262634 799e5eb80cf076fe34c9643b8078bb43

arm architecture (ARM)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_arm.deb
    Size/MD5 checksum:   254618 0d553164d3d303e096efbac3ab2dcabe
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_arm.deb
    Size/MD5 checksum:   309000 edc68fa74a8b939293ca23f7aa3a6efd
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_arm.deb
    Size/MD5 checksum:  1011704 9b9e1459b833922e31510cefab0594c0
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_arm.deb
    Size/MD5 checksum:  2901632 4ad15a531cdf51ef146f3337148a71d2

armel architecture (ARM EABI)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_armel.deb
    Size/MD5 checksum:  2924760 f06d340c4aa9f4044d5a00df6617e624
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_armel.deb
    Size/MD5 checksum:  1017348 3f72c2cb4d1d39d0fed98acd9d4409c3
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_armel.deb
    Size/MD5 checksum:   308638 f81fb9ba70eb3e5b8f3117dba5c18a6b
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_armel.deb
    Size/MD5 checksum:   258562 2b0b270a34ce0bfa9b8d7589782a820d

hppa architecture (HP PA RISC)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_hppa.deb
    Size/MD5 checksum:   262180 5bb31fdc16b4883f42f3d9a8db31b478
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_hppa.deb
    Size/MD5 checksum:   347268 025014303d4e266c8b3e7260022624e7
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_hppa.deb
    Size/MD5 checksum:  2946180 aff9d6ce1e1fefe47443116d9791eee7
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_hppa.deb
    Size/MD5 checksum:  1169546 e439f85cb7d5755488283b48c25213bc

i386 architecture (Intel ia32)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_i386.deb
    Size/MD5 checksum:   303718 a9bdcd4d31a594c196f18b916adcf29c
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_i386.deb
    Size/MD5 checksum:   259032 77d7d235c8395b14c47033158ca99a12
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_i386.deb
    Size/MD5 checksum:  2915646 fdf2b28a0b482e9b5310a69e303162a9
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_i386.deb
    Size/MD5 checksum:   958778 233e968682a24b1f7b8259552d869cc9

ia64 architecture (Intel ia64)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_ia64.deb
    Size/MD5 checksum:   272290 c833704551b7330ff002c7a486fd6326
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_ia64.deb
    Size/MD5 checksum:   410084 393d05ececb2b56c3e9cf8667bee6e37
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_ia64.deb
    Size/MD5 checksum:  1489784 30b154c46b4d3609a54f86bd2c9608d4
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_ia64.deb
    Size/MD5 checksum:  2800250 411058093b4bcf9cc241c97283b706f4

mips architecture (MIPS (Big Endian))

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_mips.deb
    Size/MD5 checksum:  1039604 93dce812de2605a1decf3a91cf1fdcb6
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mips.deb
    Size/MD5 checksum:  3050894 433d8ac69c75486c3f4ef1a8e8b571fc
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_mips.deb
    Size/MD5 checksum:   262606 24bc492fd4fb188222ce9eeb1ff0c768
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mips.deb
    Size/MD5 checksum:   319884 a9f8a2f8b13d1bbd64ca5be52fafcdec

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_mipsel.deb
    Size/MD5 checksum:  1028620 5373a76615b1208a0bcf648e1ac4d74d
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_mipsel.deb
    Size/MD5 checksum:   317226 528869d14dd652a8ff77a8d0949060ed
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_mipsel.deb
    Size/MD5 checksum:   257912 d4f5d5704b0137797635350ee6dbd74d
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_mipsel.deb
    Size/MD5 checksum:  3001244 09ffd9355ea180446462c4762118c0ea

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_powerpc.deb
    Size/MD5 checksum:  2948604 3378206f900751ead42c264fb889ded9
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_powerpc.deb
    Size/MD5 checksum:   333556 11a62eebda4b15f09bc9923c0256d4b5
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_powerpc.deb
    Size/MD5 checksum:  1031552 66e7ef314e0003a4626be23fdf7843f6
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_powerpc.deb
    Size/MD5 checksum:   259498 af3924c5043f456484598d76d6a0ca1f

s390 architecture (IBM S/390)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_s390.deb
    Size/MD5 checksum:   263080 0675ec6c2daf678d558f529eb59c45e9
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_s390.deb
    Size/MD5 checksum:   346292 1e77acadf630955325ad21d802512b39
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_s390.deb
    Size/MD5 checksum:  3021080 a59b06101c7d226f6ca526164f92c5c7
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_s390.deb
    Size/MD5 checksum:  1178440 a383e9a1ba4a2a8e1d8662031f2b7b0f

sparc architecture (Sun SPARC/UltraSPARC)

  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny2_sparc.deb
    Size/MD5 checksum:  2713414 9fb579cb2a9729a7daa00472e4886c94
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-dev_3.12.3.1-0lenny2_sparc.deb
    Size/MD5 checksum:   257226 32f907739b4b8712832ab3370616a6af
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-1d_3.12.3.1-0lenny2_sparc.deb
    Size/MD5 checksum:   997232 2803a67dba4eff8dff851f89a5363592
  
http://security.debian.org/pool/updates/main/n/nss/libnss3-tools_3.12.3.1-0lenny2_sparc.deb
    Size/MD5 checksum:   317520 32e167507b034ffc02a5371f46c968ea


  These files will probably be moved into the stable distribution on
  its next update.

- 
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce AT lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEbBAEBAgAGBQJMzxtXAAoJEL97/wQC1SS+8pkH93UBE2a/EaNub2xLT3G4K8Ga
ZlEldfLkl6IvdS74gIt3H4fvIOMkRbw9FZZgEhGGLoMvYD45RIkDWxp4bTm4GhIr
uDk5W1qsodHEYGWGOvKRE+WqOVWWTa43v2aGfqfSHBoC1tNnaHFiR9AZWmpVfWC4
PhXbhWwRO12fxxVvpgb+JS8fZd/i2ztmXC5zoruZEgwODW9+MFptWf5hUVnr5/y0
dJuJiSXktCqP3I1SSY10D2KUBgAIJ2rjTx4nwZvD+7BPRQgBtwH1Vx7kRa6dlxSp
zsVxpRYTA57RzQmvGrVkoxdwvrYhB0T8eBDkp2woR5ScLdhemtcbeiJYpTEjqA==
=rBQ3
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST AT lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster AT lists.debian.org
Archive: 87zktsg74q.fsf AT mid.deneb.enyo.de">http://lists.debian.org/87zktsg74q.fsf AT mid.deneb.enyo.de