oss-security - CVE Request 1, NSS 2, Qt: Doesn't handle wildcards in Common Name properly

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C812061.4070704@redhat.com>
Date: Fri, 03 Sep 2010 18:20:49 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security <oss-security@...ts.openwall.com>,
        Richard Moore <rich@...tpoint.ltd.uk>,
        Simon Ward <simon@...tpoint.ltd.uk>
Subject: CVE Request 1, NSS 2, Qt: Doesn't handle wildcards in Common Name
 properly

Hi Steve, vendors,

   Richard Moore and Simon Ward reported flaws in the way:

   1, Network Security Services (NSS) handled wildcard (*) character
      in the Common Name field of a x509v3 digital certificate.
      If an attacker is able to get a carefully-crafted certificate,
      signed by a Certificate Authority trusted by Firefox, the attacker
      could use the certificate during the man-in-the-middle attack and
      potentially confuse Firefox into accepting it by mistake. Different
      vulnerability than CVE-2009-2408.

      References:
      [1] http://www.westpoint.ltd.uk/advisories/wp-10-0001.txt
      [2] http://bugs.gentoo.org/show_bug.cgi?id=335731


   2, Qt software toolkit (QSslSocket) handled wildcard (*) character
      in the Common Name field of a x509v3 digital certificate.
      If an attacker is able to get a carefully-crafted certificate,
      signed by a Certificate Authority trusted by Konqueror / Arora web browsers,
      the attacker could use the certificate during the man-in-the-middle attack
      and potentially confuse Konqueror / Arora into accepting it by mistake.
      Different vulnerability than CVE-2009-2408.

      References:
     [3] http://www.westpoint.ltd.uk/advisories/wp-10-0001.txt
     [4] http://bugs.gentoo.org/show_bug.cgi?id=335730

Yet, in [1] Richard and Simon mention:
"27 August 2010  At the time of writing the NSS (Firefox) and Qt repositories
                  both contain fixes for this issue that will be included in
                  their releases."

so it is possible these two flaws already got their CVE identifiers. But if not,
could you please allocate them?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.