Security Flaw in Mozilla Firefox and NSS leading to Man-in-the-Middle Attacks

CVE-2015-7575

What is CVE-2015-7575?

A significant vulnerability was identified in Mozilla Network Security Services (NSS) prior to version 3.20.2, affecting Mozilla Firefox versions prior to 43.0.2 and Firefox ESR versions prior to 38.5.2. This vulnerability arises from the failure to properly reject MD5 signatures used in the Server Key Exchange messages during the TLS 1.2 handshake. Consequently, this flaw allows a man-in-the-middle attacker to exploit the situation, facilitating server spoofing through collision attacks, thereby compromising the integrity and security of the connection.

References