Mozilla Foundation Security Advisory 2015-71
NSS incorrectly permits skipping of ServerKeyExchange
- Announced
- July 2, 2015
- Reporter
- Karthikeyan Bhargavan
- Impact
- Moderate
- Products
- Firefox, Firefox ESR, Firefox OS, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 39
- Firefox ESR 31.8
- Firefox ESR 38.1
- Firefox OS 2.2
- SeaMonkey 2.35
- Thunderbird 31.8
- Thunderbird 38.1
Description
Security researcher Karthikeyan Bhargavan reported an issue
in Network Security Services (NSS) where the client allows for a ECDHE_ECDSA
exchange where the server does not send its ServerKeyExchange
message instead of aborting the handshake. Instead, the NSS client will take the
EC key from the ECDSA certificate. This violates the TLS protocol and also has
some security implications for forward secrecy. In this situation, the browser
thinks it is engaged in an ECDHE exchange, but has been silently downgraded to a
non-forward secret mixed-ECDH exchange instead. As a result, if False
Start is enabled, the browser will start sending data encrypted under
these non-forward-secret connection keys. This issue was fixed in NSS version
3.19.1.