CVE-2017-7502

What it actually does

Null pointer dereference in NSS (since 3.24.0) during handling of empty SSLv2 messages from remote clients, causing immediate process crash and denial of service.

Why it matters to the business

Remote attackers can repeatedly crash affected servers handling SSL/TLS connections, leading to service outages, degraded availability, and operational disruption for dependent applications such as databases.

How an attack unfolds

An attacker connects to a vulnerable server and sends a specially crafted empty SSLv2 ClientHello or similar message; the NSS library dereferences a null pointer while processing the malformed record, terminating the server process. No authentication or user interaction is required.

How to fix it

Upgrade affected packages to the fixed versions provided (postgresql on Alpine v3.10 to 10.1-r0 or newer) which incorporate the NSS patch eliminating the null dereference. Apply vendor updates for NSS across all dependent products and restart affected services.

How to confirm the fix worked

Verify installed NSS and dependent package versions match or exceed the listed fixed releases; perform connectivity tests with SSLv2-disabled clients and monitor for crashes under synthetic empty SSLv2 traffic.

Typical attack path

1. Scan for hosts exposing SSL/TLS services on standard ports
2. Send crafted empty SSLv2 handshake messages to trigger the null dereference
3. Observe server process termination and service unavailability
4. Repeat the request to maintain denial of service

How to detect it

Review application and system logs for NSS or SSL library crashes coinciding with inbound SSLv2 traffic; inspect network captures for empty or malformed SSLv2 ClientHello records and correlate with process termination events.

What your security team should do

• Immediately apply the listed package upgrades to postgresql 10.1-r0 or equivalent NSS-patched builds
• Disable SSLv2 support at the application or library level where possible
• Monitor service availability metrics and NSS-related crash logs for anomalous terminations
• Prioritize patching on internet-facing systems given the network-reachable attack vector and stable EPSS score