Re: CVE Request 1, NSS 2, Qt: Doesn't handle wildcards in Common Name properly

[Reed Loden <reed () reedloden com>]

On Fri, 03 Sep 2010 18:20:49 +0200
Jan Lieskovsky <jlieskov () redhat com> wrote:

>    Richard Moore and Simon Ward reported flaws in the way:
>
>    1, Network Security Services (NSS) handled wildcard (*) character
>       in the Common Name field of a x509v3 digital certificate.
>       If an attacker is able to get a carefully-crafted certificate,
>       signed by a Certificate Authority trusted by Firefox, the attacker
>       could use the certificate during the man-in-the-middle attack and
>       potentially confuse Firefox into accepting it by mistake. Different
>       vulnerability than CVE-2009-2408.
>
>       References:
>       [1] http://www.westpoint.ltd.uk/advisories/wp-10-0001.txt
>       [2] http://bugs.gentoo.org/show_bug.cgi?id=335731

Mozilla has assigned this CVE-2010-3170. We're tracking this as
https://bugzilla.mozilla.org/show_bug.cgi?id=578697.

~reed
Mozilla Security Group

-- 
Reed Loden - <reed () reedloden com>