CVE-2014-1492

What it actually does

The cert_TestHostName function in NSS before 3.16 accepts an embedded wildcard character inside an IDN U-label during certificate hostname validation, bypassing intended domain matching rules and permitting spoofed certificates to pass verification.

Why it matters to the business

Organizations still running legacy NSS versions face risk of traffic interception or impersonation of trusted sites; the issue has been public for over a decade with public exploits available, increasing urgency for any remaining unpatched deployments.

How an attack unfolds

An attacker obtains or forges a certificate containing a wildcard inside an internationalized domain name U-label, positions themselves as a man-in-the-middle, and presents the certificate to a client application that uses the vulnerable NSS library; the library incorrectly accepts the certificate as valid for the target domain.

How to fix it

Upgrade Mozilla Network Security Services to version 3.16 or later; replace any embedded or statically linked copies of the vulnerable NSS library in dependent applications.

How to confirm the fix worked

Inventory all systems for NSS versions prior to 3.16; test certificate validation behavior with a crafted IDN wildcard certificate; confirm successful upgrade by verifying NSS version strings and re-testing hostname matching.

Typical attack path

1. Craft or obtain an X.509 certificate embedding a wildcard in an IDN U-label
2. Position as MITM on the network path to the target client
3. Present the malicious certificate during TLS handshake
4. NSS hostname check accepts the certificate due to improper U-label wildcard handling

How to detect it

Search application and system logs for NSS version strings or certificate validation events involving internationalized domain names; inspect process binaries and shared libraries for versions older than 3.16; review TLS handshake artifacts for unexpected wildcard matches in IDN labels.

What your security team should do

• Prioritize upgrade of any remaining NSS instances below 3.16
• Scan build pipelines and third-party dependencies for static NSS linkage
• Review certificate validation logs for anomalies on legacy systems
• Disable or isolate applications still using unpatched NSS