Sun Compromised Browser Certificates Vulnerability

Bugtraq ID:	1851
Class:	Unknown
CVE:
Remote:	Yes
Local:	Unknown
Published:	Oct 24 2000 12:00AM
Updated:	Oct 24 2000 12:00AM
Credit:	This vulnerability was made first made public in Sun Microsystems, Inc. Security Bulletin #00198 on October 24, 2000.
Vulnerable:	Netscape Communicator 4.75 - Caldera OpenLinux Desktop 2.3 - Caldera OpenLinux eBuilder 3.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - Mandriva Linux Mandrake 6.1 - Mandriva Linux Mandrake 6.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha - Redhat Linux 6.1 sparc - Redhat Linux 6.1 i386 - Redhat Linux 6.1 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 alpha - Redhat Linux 6.0 - Redhat Linux 5.2 sparc - Redhat Linux 5.2 i386 - Redhat Linux 5.2 alpha - SCO eDesktop 2.4 - SCO eServer 2.3 + SGI IRIX 6.5.12 + SGI IRIX 6.5.11 - SuSE Linux 7.0 Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Internet Explorer 5.0.1 for Windows 98 - Microsoft Windows 98 - Microsoft Windows 98
Not Vulnerable:

Sun Compromised Browser Certificates Vulnerability

Browser Certificates are cryptographic data which allow a client to communicate and view information securely over an untrusted connection. Sun has issued this warning as the result of two trusted browser certificates being potentially compromised.

These certificates were limited in distribution and have the following serial numbers:

Internet Explorer: 3181 B12D C422 5DAC A340 CF86 2710 ABE6
Netscape: 17:05:FB:13:A2:2F:9A:F3:C1:30:F5:62:6E:12:50:4C

Sun Compromised Browser Certificates Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Sun Compromised Browser Certificates Vulnerability

Solution:
Sun has issued instructions available at http://sunsolve.sun.com/securitypatch to help a client determine the status of certificates on suspected browsers.

Sun Compromised Browser Certificates Vulnerability

References: