CVE-2019-17006
📋 TL;DR
CVE-2019-17006 is a buffer overflow vulnerability in Network Security Services (NSS) cryptographic library due to missing length checks. This allows attackers to crash applications using NSS, potentially leading to denial of service or remote code execution. Any system or application using NSS versions before 3.46 is affected.
💻 Affected Systems
- Network Security Services (NSS)
- Mozilla Firefox
- Thunderbird
- Red Hat Enterprise Linux
- SUSE Linux Enterprise Server
- Ubuntu
- Debian
- Siemens industrial products
- NetApp storage systems
📦 What is this software?
Solidfire by Netapp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes causing denial of service, disrupting TLS/SSL connections and secure communications.
If Mitigated
Limited to denial of service if proper input validation exists in calling applications.
🎯 Exploit Status
Exploitation requires sending malformed cryptographic data to applications using vulnerable NSS functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NSS 3.46 or later
Vendor Advisory: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
Restart Required: Yes
Instructions:
1. Update NSS library to version 3.46 or later. 2. Update operating system packages that include NSS. 3. Restart affected services and applications. 4. For embedded systems, update firmware from vendor.
🔧 Temporary Workarounds
Input validation in applications
allAdd length checks in application code before calling NSS cryptographic functions.
Network filtering
allBlock or filter malformed cryptographic data at network perimeter.
🧯 If You Can't Patch
- Isolate affected systems in segmented network zones
- Implement strict access controls and monitoring for systems using NSS
🔍 How to Verify
Check if Vulnerable:
Check NSS version with 'strings /usr/lib/libnss3.so | grep Version' or similar library path.Check Version:
strings /usr/lib/libnss3.so | grep 'Version: NSS' 2>/dev/null || echo 'NSS not found or version info unavailable'Verify Fix Applied:
Verify NSS version is 3.46 or higher using version check command.📡 Detection & Monitoring
Log Indicators:
- Application crashes related to cryptographic operations
- TLS/SSL handshake failures
- Segmentation faults in processes using NSS
Network Indicators:
- Malformed cryptographic packets
- Unexpected termination of secure connections
SIEM Query:
source=* ("segmentation fault" OR "buffer overflow") AND ("NSS" OR "libnss")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1539788
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
- https://security.netapp.com/advisory/ntap-20210129-0001/
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
- https://bugzilla.mozilla.org/show_bug.cgi?id=1539788
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
- https://security.netapp.com/advisory/ntap-20210129-0001/
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
