CVE-2015-2721

What it actually does

The flaw stems from incorrect TLS state machine transitions in NSS, allowing an active MITM to drop messages such as ServerKeyExchange and force a non-forward-secret cipher suite without detection.

Why it matters to the business

Encrypted sessions between users and servers using affected Mozilla products or NSS libraries can be downgraded, exposing sensitive data in transit and undermining trust in secure communications for organizations relying on these components.

How an attack unfolds

An attacker positioned on the network observes a TLS handshake, selectively blocks forward-secrecy negotiation messages, and completes the session using weaker parameters that the client and server both accept due to the flawed state handling.

How to fix it

Upgrade NSS to version 3.19 or later, Firefox to 39.0 or ESR 31.8/38.1 or later, Thunderbird to 38.1 or later, and any other affected products to their respective patched releases that correct TLS state transitions.

How to confirm the fix worked

Confirm NSS and dependent product versions meet or exceed the fixed releases; perform TLS handshake tests that attempt message suppression and verify forward-secrecy parameters are enforced.

Typical attack path

1. Position as network MITM between client and server
2. Intercept ClientHello and ServerHello messages
3. Drop ServerKeyExchange or equivalent forward-secrecy messages
4. Allow handshake to complete with non-PFS cipher suite
5. Decrypt or modify subsequent traffic without detection

How to detect it

Examine web server and client logs for TLS sessions that completed without expected ServerKeyExchange or with unexpectedly weak cipher suites; correlate with network captures showing dropped handshake messages.

What your security team should do

• Inventory all systems using NSS or listed Mozilla products and prioritize upgrades
• Enable TLS 1.2+ with only PFS cipher suites in configuration where possible
• Monitor vendor advisories for any remaining downstream packages
• Review network logs for anomalous TLS handshakes lacking expected key exchange messages