Bug 1015547 (CVE-2016-8635)

Summary: VUL-0: CVE-2016-8635: mozilla-nss: small-subgroups attack flaw
Product: [Novell Products] SUSE Security Incidents Reporter: Marcus Meissner <meissner>
Component: IncidentsAssignee: Petr Cerny <pcerny>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: astieger, meissner, roberto.angelino, smash_bz, wolfgang
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/176378/
Whiteboard: CVSSv2:SUSE:CVE-2016-8635:4.3:(AV:N/AC:M/Au:N/C:P/I:N/A:N) maint:planned:update maint:released:oes11-sp2:63586
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Marcus Meissner 2016-12-14 13:41:03 UTC
via redhat bug rh#1391818

It was found that Diffie Hellman Client key exchange handling in NSS, was vulnerable to small subgroup confinement attack[1]. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.


[1] https://en.wikipedia.org/wiki/Small_subgroup_confinement_attack

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1391818
Comment 2 Petr Cerny 2016-12-14 15:48:38 UTC
The RH package has a single patch referring to https://bugzilla.mozilla.org/show_bug.cgi?id=1314604.

Looking further, it seems to be excerpt from https://hg.mozilla.org/projects/nss/revfdee095b5e2e. I'll add the RH patch into our packages.
Comment 3 Petr Cerny 2016-12-14 15:50:04 UTC
Wolfgang, any chance you could cc me on the mozilla bug? Thanks.
Comment 4 Wolfgang Rosenauer 2016-12-14 19:26:04 UTC
Even I don't have access to that one but I requested information from within the security group. Will report back about the result.
Comment 5 Wolfgang Rosenauer 2016-12-15 06:10:08 UTC
The upstream bug is now open.
Comment 11 Swamp Workflow Management 2017-04-26 06:23:35 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2017-05-03.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63559
Comment 12 Swamp Workflow Management 2017-05-04 13:14:20 UTC
SUSE-SU-2017:1175-1: An update that fixes 29 vulnerabilities is now available.

Category: security (important)
Bug References: 1015499,1015547,1021636,1030071,1035082,983639
CVE References: CVE-2016-1950,CVE-2016-2834,CVE-2016-8635,CVE-2016-9574,CVE-2017-5429,CVE-2017-5432,CVE-2017-5433,CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5437,CVE-2017-5438,CVE-2017-5439,CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444,CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5459,CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465,CVE-2017-5469
Sources used:
SUSE OpenStack Cloud 5 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Manager Proxy 2.1 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Manager 2.1 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Linux Enterprise Server 11-SP4 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    MozillaFirefox-45.9.0esr-71.2, mozilla-nspr-4.13.1-32.1, mozilla-nss-3.29.5-46.1
Comment 13 Swamp Workflow Management 2017-05-11 19:15:27 UTC
SUSE-SU-2017:1248-1: An update that fixes 29 vulnerabilities is now available.

Category: security (important)
Bug References: 1015499,1015547,1021636,1026102,1030071,1035082,983639
CVE References: CVE-2016-1950,CVE-2016-2834,CVE-2016-8635,CVE-2016-9574,CVE-2017-5429,CVE-2017-5432,CVE-2017-5433,CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5437,CVE-2017-5438,CVE-2017-5439,CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444,CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5459,CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465,CVE-2017-5469
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    MozillaFirefox-45.9.0esr-105.1, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    MozillaFirefox-45.9.0esr-105.1, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Server for SAP 12 (src):    MozillaFirefox-45.9.0esr-105.1, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    MozillaFirefox-45.9.0esr-105.1, java-1_8_0-openjdk-1.8.0.121-23.4, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Server 12-SP2 (src):    MozillaFirefox-45.9.0esr-105.1, java-1_8_0-openjdk-1.8.0.121-23.4, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Server 12-SP1 (src):    MozillaFirefox-45.9.0esr-105.1, java-1_8_0-openjdk-1.8.0.121-23.4, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Server 12-LTSS (src):    MozillaFirefox-45.9.0esr-105.1, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    MozillaFirefox-45.9.0esr-105.1, java-1_8_0-openjdk-1.8.0.121-23.4, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    MozillaFirefox-45.9.0esr-105.1, java-1_8_0-openjdk-1.8.0.121-23.4, mozilla-nspr-4.13.1-18.1, mozilla-nss-3.29.5-57.1
Comment 14 Marcus Meissner 2017-10-24 13:14:45 UTC
released