Welcome to WebmasterWorld Guest from 184.72.177.182

Forum Moderators: incrediBILL

Message Too Old, No Replies

FireFox - potential exploit regarding certificates

This maybe of interest

     
1:35 pm on Jul 20, 2004 (gmt 0)

New User

10+ Year Member

joined:June 3, 2004
posts:31
votes: 0



Marcel Boesch has reported a vulnerability in Mozilla and Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service).

Arbitrary root certificates are imported silently without presenting users with a import dialog box when the MIME type is specified as: "application/x-x509-email-cert".

Due to another problem, this can e.g be exploited by malicious websites or HTML-based emails to prevent users from accessing valid SSL sites by placing invalid root certificates with the same DN (Distinguished Name) as a valid root certificate in a user's certificate store.

Successful exploitation prevents access to SSL-based sites that use a trusted root certificate with the same DN as a malicious root certificate in the user's certificate store.

The vulnerability has been reported in Mozilla 1.6, 1.7, and 1.7.1 for Windows and Linux, and in Mozilla Firefox 0.8 and 0.9.2. Other versions may also be affected.

Solution:
Don't visit untrusted websites.

Check the certificate store and delete untrusted certificates if an error message is displayed with error code -8182 ("certificate presented by [domain] is invalid or corrupt") when attempting to access a SSL-based website.

Mozilla:
"Edit" -> "Preferences" -> "Privacy & Security" -> "Certificates" -> "Manage Certificates..." -> "Authorities".

Firefox:
"Tools" -> "Options..." -> "Advanced" -> "Certificates" -> "Manage Certificates..." -> "Authorities".

1:51 pm on July 20, 2004 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:May 22, 2002
posts:1001
votes: 0


And so it starts. (And I doubt it'll end there!). Thats what, two security warnings in two weeks?

Thanks for the heads up gi3wgk.

2:14 pm on July 20, 2004 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Mar 10, 2004
posts:1342
votes: 0


Yah no kidding.

People are kidding themselves to think that the other browsers don't face the same problem as IE.

The only way to create secure software is to stop innovating. Which is why I still run the old version of apache..

2:18 pm on July 20, 2004 (gmt 0)

Full Member

10+ Year Member

joined:Mar 8, 2004
posts:311
votes: 0


Does anyone have any reference for this? I can't see anything at mozilla.org or the Full-Disclosre mailling list archive. Importing arbitrary root certificates is far worse than a DoS. It would allow attackers to create then own certificates signed by the fake root in any name they want.
2:31 pm on July 20, 2004 (gmt 0)

Junior Member

10+ Year Member

joined:June 16, 2004
posts:70
votes: 0


Little exploits come out all the time, this is nothing new. People just started paying attentions. secunia dot com had that exploit a few days ago if I remember correctly.

Successful exploitation prevents access to SSL-based sites that use a trusted root certificate with the same DN as a malicious root certificate in the user's certificate store.

succesful exploitation prevents someone from being able to open some secure pages.

3:44 pm on July 20, 2004 (gmt 0)

Full Member

10+ Year Member

joined:July 30, 2003
posts:322
votes: 0


Thats what, two security warnings in two weeks?

More like the first uniquly Mozilla security warning. The last one was really a Windows OS security problem that affected Mozilla, IE, Word, OE and possibly Opera and has since been fixed by MS.