Multiple Web Browsers SSL Certificate SubjectAltName Validation Weakness
BID:26501
Info
Multiple Web Browsers SSL Certificate SubjectAltName Validation Weakness
| Bugtraq ID: | 26501 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 19 2007 12:00AM |
| Updated: | Nov 20 2007 02:34PM |
| Credit: | Nils Toedtmann reported this issue. |
| Vulnerable: |
Opera Software Opera Web Browser 9.24 Opera Software Opera Web Browser 9.23 Mozilla Firefox 2.0 .9 Mozilla Firefox 2.0 .8 KDE Konqueror 3.95 KDE Konqueror 3.5.5 Apple Safari 3.0.4 Beta for Windows Apple Safari 2.0.4 |
| Not Vulnerable: | |
Discussion
Multiple Web Browsers SSL Certificate SubjectAltName Validation Weakness
Multiple web browsers fail to validate SSL certificates properly. This issue occurs because the applications fail to properly handle 'subjectAltName' extensions to X.509 certificates.
Successfully exploiting this issue may aid attackers in phishing-style attacks by bypassing security warnings when invalid certificates are used in SSL HTTP connections.
The following browsers are reported vulnerable:
Mozilla Firefox (and browsers based on the Gecko rendering engine)
Opera
Konqueror (and browsers based on the KHTML rendering engine, such as Apple's Safari).
Other browsers may also be affected.
This BID may be split into individual records as vendors disclose more information about individual browsers.
Multiple web browsers fail to validate SSL certificates properly. This issue occurs because the applications fail to properly handle 'subjectAltName' extensions to X.509 certificates.
Successfully exploiting this issue may aid attackers in phishing-style attacks by bypassing security warnings when invalid certificates are used in SSL HTTP connections.
The following browsers are reported vulnerable:
Mozilla Firefox (and browsers based on the Gecko rendering engine)
Opera
Konqueror (and browsers based on the KHTML rendering engine, such as Apple's Safari).
Other browsers may also be affected.
This BID may be split into individual records as vendors disclose more information about individual browsers.
Exploit / POC
Multiple Web Browsers SSL Certificate SubjectAltName Validation Weakness
Attackers use readily available SSL utilities to create certificates sufficient to exploit this issue.
Attackers use readily available SSL utilities to create certificates sufficient to exploit this issue.
Solution / Fix
Multiple Web Browsers SSL Certificate SubjectAltName Validation Weakness
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
References
Multiple Web Browsers SSL Certificate SubjectAltName Validation Weakness
References:
References:
- Konqueror Homepage (KDE)
- Opera Homepage (Opera Software)
- Phishing for Confirmations: Certificate spoofing with subjectAltName and domain (Nils Toedtmann)
- Safari Homepage (Apple)
- Vendor Homepage (Mozilla Foundation)
- Certificate spoofing issue with Mozilla, Konqueror, Safari 2 (Nils Toedtmann