Improper Securing of Client-Initiated Renegotiation in Mozilla NSS

CVE-2011-5094

What is CVE-2011-5094?

The Mozilla Network Security Services (NSS) 3.x vulnerability arises from inadequate restrictions on client-initiated renegotiation within SSL and TLS protocols. Attackers can exploit this flaw to launch denial-of-service (DoS) attacks by performing multiple renegotiations in a single connection, leading to excessive CPU usage and potentially impacting system performance. It is crucial to note that while the vulnerability exists within the NSS, server deployments are also responsible for implementing safeguards against inappropriate renegotiation within their environments.

References