Data Smuggling Vulnerability in Mozilla Network Security Services
CVE-2014-1569
Currently unrated
What is CVE-2014-1569?
The definite_length_decoder function in Mozilla's Network Security Services (NSS) prior to version 3.16.2.4 and 3.17.x before 3.17.3 is susceptible to vulnerabilities due to inadequate verification of the DER encoding format of ASN.1 lengths. This flaw can be exploited by remote attackers through crafted long byte sequences in encoding, potentially enabling data-smuggling attacks. These attacks take advantage of the SEC_QuickDERDecodeItem function's improper management of arbitrary-length encodings, which can lead to serious security implications.