In the process of its ongoing research, the Intel Security Advanced Threat Research Team (ATR) has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites impersonating as legitimate businesses and other organizations.

The Mozilla NSS library is a set of libraries designed to support cross-platform development of security-enabled client and server applications.

Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards. NSS provides open source implementation of the crypto libraries used by AOL, Red Hat, Google, and other companies in a variety of products, including the following:

• AOL Instant Messenger (AIM)
• Open source client applications, such as Evolution, Pidgin, and Apache OpenOffice
• Server products such as Red Hat: Red Hat Directory Server, Red Hat Certificate System, and the mod_nss SSL module for the Apache web
• Server products from the Sun Java Enterprise System

In addition, NSS is commonly used in the Firefox web browser and is can also be found in Thunderbird, Seamonkey, and other Mozilla products.  The critical signature vulnerably, dubbed “BERserk”, allows attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS.  Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we navigate what we perceive to be secure websites.

Why it’s called BERserk

This attack exploits a vulnerability in the parsing of ASN.1 encoded messages during signature verification. ASN.1 messages are made up of various parts that are encoded using BER (Basic Encoding Rules) and/or DER (Distinguished Encoding Rules). This attack exploits the length of a field in BER encoding can be made to use many bytes of data. In vulnerable implementations, these bytes are then skipped during parsing. This condition enables the attack.  This is a variation on the Bleichenbacher PKCS#1 RSA Signature Verification vulnerability of 2006.

How is it Being Addressed?

“Upon discovery of this issue, the Intel Security ATR team notified Mozilla to facilitate the mitigation and resolution of the vulnerability. We also engaged CERT/CC to ensure that all affected parties are responsibly and effectively notified and given mitigation guidance on this issue, and to review other commonly used cryptographic libraries for similar issues,” stated James Walter, director of advanced threat research of Intel Security.

The Intel Security Advanced Threat Research team is continuing to work with CERT/CC in addition to reviewing other commonly used cryptographic libraries for this issue.  They will continue to update users and affected parties as new details emerge.  The team will also be releasing a paper with full technical details on this potential exploit.

McAfee Product Coverage & Countermeasures

McAfee Vulnerability Manager (MVM) will release an update to check for vulnerable systems and report their exposure.   McAfee will continue to review other potential mitigation methods and technologies and will keep customers up to date.

What Users can do Immediately

If you’re a Firefox browser user, you can take immediate action by updating your browser with the latest patches from Mozilla. Google has also released updates for Google Chrome and ChromeOS, as these products also utilize the vulnerable library.

As this issue unfolds, Intel Security will continue to provide updates on effective countermeasures and proper mitigation strategies.