nss: CERT_DecodeCertPackage() crash with Netscape Certificate Sequences 



I noticed that the main entrypoint for decoding DER blobs in NSS, CERT_DecodeCertPackage(), actually handles multiple formats including PEM, PKCS7, and old Netscape Certificate Sequences.

You can generate a Netscape Certificate Sequence with the OpenSSL nseq tool, I just did this:

$ openssl nseq -in mail.google.com.pem -toseq -out nseq.pem
I guessed that this format might not have been as well audited as others, so fuzzed it and it crashed with a NULL deref quickly.

Test case attached, I'm guessing this means any client or server that handles untrusted certificates can be crashed, I didn't try it against Firefox.

You can verify it like this:

$ certutil -d \".\" -A -n test -t \"p,p,p\" -i nss-nseq-crash.der
Segmentation fault

I reported this upstream as a denial of service issue, some network daemons use NSS (like slapd, iirc)

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.



Found by: taviso@google.com