CVE-2018-18508

What it actually does

A malformed signature supplied to NSS triggers a null pointer dereference during signature verification, causing an immediate process crash and denial of service.

Why it matters to the business

Services and devices relying on the vulnerable NSS library can be forced offline by remote attackers, interrupting encrypted communications and availability for any dependent applications or industrial equipment.

How an attack unfolds

An attacker crafts a malformed digital signature and sends it over the network to a target application or device that performs signature verification with the vulnerable NSS library, resulting in a null dereference crash.

How to fix it

Upgrade NSS to version 3.36.7 or 3.41.1 or later. For affected Siemens RUGGEDCOM products, apply any available firmware updates that incorporate the patched NSS library.

How to confirm the fix worked

Verify the installed NSS version meets or exceeds 3.36.7 or 3.41.1, then test signature verification paths with known malformed inputs to confirm absence of crashes.

Typical attack path

1. Identify a network service or device that uses NSS for signature verification
2. Craft a specially malformed signature payload
3. Transmit the payload to the target via an applicable protocol
4. Trigger signature processing in NSS to induce the null dereference crash

How to detect it

Review application and system logs for unexpected crashes in NSS-dependent processes, unusual null dereference errors, and monitor for repeated failed signature verification attempts from external sources.

What your security team should do

• Prioritize patching NSS in all environments and Siemens RUGGEDCOM devices to the fixed versions
• Inventory applications and firmware using NSS to identify exposure
• Monitor process stability for NSS-linked services and apply vendor updates promptly