CVE-2019-17006

What it actually does

Missing length checks on inputs to cryptographic primitives in NSS allow a caller that skips its own validation to trigger a buffer overflow, resulting in a crash or potential memory corruption.

Why it matters to the business

Affected network devices and systems from Siemens, NetApp, and Mozilla-dependent products may experience denial of service or remote compromise, increasing downtime risk and incident response costs across industrial and storage environments.

How an attack unfolds

An attacker sends a network packet or API call containing oversized data to an NSS cryptographic function; because the library performs no length validation, the data overruns a buffer, allowing control-flow hijacking or a crash when the calling application also omits sanity checks.

How to fix it

Upgrade NSS to version 3.46 or newer on all affected systems; where vendor firmware updates are available for Siemens RUGGEDCOM ROX and NetApp HCI/SolidFire products, apply those patches immediately.

How to confirm the fix worked

Inventory installed NSS versions across the environment and confirm each instance reports 3.46 or later; re-test affected services with previously crashing inputs to verify stability.

Typical attack path

1. Identify a service or device that links against a vulnerable NSS library and exposes cryptographic operations over the network.
2. Craft a malformed input that exceeds expected buffer sizes for the targeted primitive.
3. Transmit the input without prior length sanitization by the application.
4. Trigger the overflow to achieve a crash for denial of service or attempt memory corruption for code execution.

How to detect it

Review application and system logs for unexpected crashes in NSS-linked processes around the time of suspicious network traffic; correlate with NSS version information to identify unpatched instances that may have been targeted.

What your security team should do

• Prioritize patching of internet-facing or high-value devices that use NSS cryptographic functions.
• Enable application-level input validation around NSS calls until libraries are updated.
• Monitor vendor advisories for Siemens and NetApp firmware releases that incorporate the NSS fix.