FireFox - potential exploit regarding certificates

This maybe of interest

[gi3wgk]

Marcel Boesch has reported a vulnerability in Mozilla and Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service).

Arbitrary root certificates are imported silently without presenting users with a import dialog box when the MIME type is specified as: "application/x-x509-email-cert".

Due to another problem, this can e.g be exploited by malicious websites or HTML-based emails to prevent users from accessing valid SSL sites by placing invalid root certificates with the same DN (Distinguished Name) as a valid root certificate in a user's certificate store.

Successful exploitation prevents access to SSL-based sites that use a trusted root certificate with the same DN as a malicious root certificate in the user's certificate store.

The vulnerability has been reported in Mozilla 1.6, 1.7, and 1.7.1 for Windows and Linux, and in Mozilla Firefox 0.8 and 0.9.2. Other versions may also be affected.

Solution:
Don't visit untrusted websites.

Check the certificate store and delete untrusted certificates if an error message is displayed with error code -8182 ("certificate presented by [domain] is invalid or corrupt") when attempting to access a SSL-based website.

Mozilla:
"Edit" -> "Preferences" -> "Privacy & Security" -> "Certificates" -> "Manage Certificates..." -> "Authorities".

Firefox:
"Tools" -> "Options..." -> "Advanced" -> "Certificates" -> "Manage Certificates..." -> "Authorities".

[Sanenet]

And so it starts. (And I doubt it'll end there!). Thats what, two security warnings in two weeks?

Thanks for the heads up gi3wgk.

[blaze]

Yah no kidding.

People are kidding themselves to think that the other browsers don't face the same problem as IE.

The only way to create secure software is to stop innovating. Which is why I still run the old version of apache..

[py9jmas]

Does anyone have any reference for this? I can't see anything at mozilla.org or the Full-Disclosre mailling list archive. Importing arbitrary root certificates is far worse than a DoS. It would allow attackers to create then own certificates signed by the fake root in any name they want.

[Dudermont]

Little exploits come out all the time, this is nothing new. People just started paying attentions. secunia dot com had that exploit a few days ago if I remember correctly.

Successful exploitation prevents access to SSL-based sites that use a trusted root certificate with the same DN as a malicious root certificate in the user's certificate store.

succesful exploitation prevents someone from being able to open some secure pages.

[Farix]

Thats what, two security warnings in two weeks?

More like the first uniquly Mozilla security warning. The last one was really a Windows OS security problem that affected Mozilla, IE, Word, OE and possibly Opera and has since been fixed by MS.