homepage Welcome to WebmasterWorld Guest from 54.145.172.149
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Home / Forums Index / Browsers / Firefox Browser Usage and Support
Forum Library, Charter, Moderators: incrediBILL

Firefox Browser Usage and Support Forum

    
FireFox - potential exploit regarding certificates
This maybe of interest
gi3wgk

10+ Year Member



 
Msg#: 374 posted 1:35 pm on Jul 20, 2004 (gmt 0)


Marcel Boesch has reported a vulnerability in Mozilla and Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service).

Arbitrary root certificates are imported silently without presenting users with a import dialog box when the MIME type is specified as: "application/x-x509-email-cert".

Due to another problem, this can e.g be exploited by malicious websites or HTML-based emails to prevent users from accessing valid SSL sites by placing invalid root certificates with the same DN (Distinguished Name) as a valid root certificate in a user's certificate store.

Successful exploitation prevents access to SSL-based sites that use a trusted root certificate with the same DN as a malicious root certificate in the user's certificate store.

The vulnerability has been reported in Mozilla 1.6, 1.7, and 1.7.1 for Windows and Linux, and in Mozilla Firefox 0.8 and 0.9.2. Other versions may also be affected.

Solution:
Don't visit untrusted websites.

Check the certificate store and delete untrusted certificates if an error message is displayed with error code -8182 ("certificate presented by [domain] is invalid or corrupt") when attempting to access a SSL-based website.

Mozilla:
"Edit" -> "Preferences" -> "Privacy & Security" -> "Certificates" -> "Manage Certificates..." -> "Authorities".

Firefox:
"Tools" -> "Options..." -> "Advanced" -> "Certificates" -> "Manage Certificates..." -> "Authorities".

 

Sanenet

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 374 posted 1:51 pm on Jul 20, 2004 (gmt 0)

And so it starts. (And I doubt it'll end there!). Thats what, two security warnings in two weeks?

Thanks for the heads up gi3wgk.

blaze

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 374 posted 2:14 pm on Jul 20, 2004 (gmt 0)

Yah no kidding.

People are kidding themselves to think that the other browsers don't face the same problem as IE.

The only way to create secure software is to stop innovating. Which is why I still run the old version of apache..

py9jmas

10+ Year Member



 
Msg#: 374 posted 2:18 pm on Jul 20, 2004 (gmt 0)

Does anyone have any reference for this? I can't see anything at mozilla.org or the Full-Disclosre mailling list archive. Importing arbitrary root certificates is far worse than a DoS. It would allow attackers to create then own certificates signed by the fake root in any name they want.

Dudermont

10+ Year Member



 
Msg#: 374 posted 2:31 pm on Jul 20, 2004 (gmt 0)

Little exploits come out all the time, this is nothing new. People just started paying attentions. secunia dot com had that exploit a few days ago if I remember correctly.

Successful exploitation prevents access to SSL-based sites that use a trusted root certificate with the same DN as a malicious root certificate in the user's certificate store.

succesful exploitation prevents someone from being able to open some secure pages.

Farix

10+ Year Member



 
Msg#: 374 posted 3:44 pm on Jul 20, 2004 (gmt 0)

Thats what, two security warnings in two weeks?

More like the first uniquly Mozilla security warning. The last one was really a Windows OS security problem that affected Mozilla, IE, Word, OE and possibly Opera and has since been fixed by MS.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Browsers / Firefox Browser Usage and Support
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved