Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Mozilla NSS空字符CA SSL证书验证绕过安全限制漏洞
Vulnerability Description
Mozilla Network Security Services（NSS）是美国Mozilla基金会的一个函数库（网络安全服务库）。该产品可跨平台提供SSL、S/MIME和其他Internet安全标准支持。 NSS库在处理SSL客户端与发布服务器证书的CA之间SSL证书中域名的时候存在不匹配的情况。如果恶意用户从带有无效空字符的主机名请求了证书，只要请求者拥有空字符后指定的域，大多数CA都会发布证书，但大多数SSL客户端(浏览器)都会忽略这部分名称，使用空字符之前没有验证的部分，这就允许攻击者在中间人攻
CVSS Information
N/A
Vulnerability Type
N/A