Mozilla Firefox SSL Certificate Validation Security Weakness

Bugtraq ID:	48064
Class:	Access Validation Error
CVE:	CVE-2011-0082
Remote:	Yes
Local:	No
Published:	May 31 2011 12:00AM
Updated:	May 31 2011 12:00AM
Credit:	Jakub Wilk.
Vulnerable:	Mozilla Firefox 4.0.1 Mozilla Firefox 4.0 Beta1 Mozilla Firefox 4.0 Beta1 Mozilla Firefox 4.0
Not Vulnerable:

Mozilla Firefox SSL Certificate Validation Security Weakness

Mozilla Firefox is prone to a security weakness because it fails to properly validate SSL certificates under certain circumstances.

This results in users having a false sense of security which may aid attackers in phishing-style attacks by bypassing security warnings when invalid certificates are used in SSL HTTP connections.

Firefox 4.0.x versions are vulnerable.

Mozilla Firefox SSL Certificate Validation Security Weakness

Attackers can use readily available tools to exploit this issue.

Mozilla Firefox SSL Certificate Validation Security Weakness

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Mozilla Firefox SSL Certificate Validation Security Weakness

References:

• #627552 iceweasel doesn't (re)validate certificates when loading HTTPS page from (Jakub Wilk)
  
• Bug 660749 - (CVE-2011-0082) Firefox doesn't (re)validate certificates when load (Huzaifa Sidhpurwala )
  
• Bug 709165 - firefox: doesn't (re)validate certificates when loading HTTPS page (Red Hat)
  
• Mozilla Firefox Homepage (Mozilla)