The Intel Security Advanced Threat Research Team has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites masquerading as legitimate businesses and other organizations.
The Mozilla NSS library, commonly utilized in the Firefox web browser, can also be found in Thunderbird, Seamonkey, and other Mozilla products. Dubbed “BERserk”, this vulnerability allows for attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS. Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we traverse what we perceive to be secure websites.
What users can do immediately
Individual Firefox browser users can take immediate action by updating their browsers with the latest patches from Mozilla.
Google has also released updates for Google Chrome and ChromeOS, as these products also utilize the vulnerable library.
Ensuring that privacy and integrity be maintained is core to what we do at Intel Security. As this issue unfolds we will continue to provide updates on effective countermeasures and proper mitigation strategies.
Read the whole story at McAfee Blog