[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5501198C.8060405@redhat.com>
Date: Wed, 11 Mar 2015 22:43:56 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not
checking hostnames in certs properly CVE-2015-1777
On 03/11/2015 09:03 PM, Michael Samuel wrote:
> Hi,
>
> On 12 March 2015 at 11:07, Kurt Seifried <kseifried@...hat.com> wrote:
>>> You can test for the common bugs extremely easily - you need two types of
>>
>> If only it were so simple. Seriously, life would be awesome.
>>
>> What about expired certificates?
>> What about certificates that are properly signed but not yet valid?
>
> Sure, you could test these too, but I'd argue these are policy issues,
> not security bugs.
If your SSL/TLS implementation accepts expired certs as being ok, then
you have a problem.
> Where is an attacker going to get the private key for an expired cert,
> but be unable to
> find the current one?
By stealing it? Certificate revocation doesn't work. Otherwise we
wouldn't have vendors shipping browser updates to invalidate known to be
compromised certificates, we'd be relying on CRL/OCSP and not hacks like
OCSP stapling.
>> What about a certificate signed for the correct hostname by a system
>> trusted CA? (some apps are supposed to only trust a specific CA).
>
> That's a policy bug too, not an easily exploitable security bug
> (unless one of your
> system CAs is compromised). Does RedHat actually ship anything that
> does pinning?
That's a real world bug. Logic error "trust properly signed cert" vs.
"trust specific CA signed cert".
>> These are all very common issues.
>
> Not nearly as common or exploitable as not checking the certificate at
> all, of which I've
> reported plenty of to RedHat and others over the past couple of years.
Uhm. Did you not look at any of the cve.mitre.org links I sent? These
are incredibly common failures. Hint: if some class of bug has a bunch
of CVE's you can multiply it by 100 or more for the number of affected
real world cases (and that's in English software alone).
> Michael
Anyways I think we're sufficiently off topic now.
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
