oss-sec mailing list archives
Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 11 Mar 2015 22:43:56 -0600
On 03/11/2015 09:03 PM, Michael Samuel wrote:
Hi, On 12 March 2015 at 11:07, Kurt Seifried <kseifried () redhat com> wrote:You can test for the common bugs extremely easily - you need two types ofIf only it were so simple. Seriously, life would be awesome. What about expired certificates? What about certificates that are properly signed but not yet valid?Sure, you could test these too, but I'd argue these are policy issues, not security bugs.
If your SSL/TLS implementation accepts expired certs as being ok, then you have a problem.
Where is an attacker going to get the private key for an expired cert, but be unable to find the current one?
By stealing it? Certificate revocation doesn't work. Otherwise we wouldn't have vendors shipping browser updates to invalidate known to be compromised certificates, we'd be relying on CRL/OCSP and not hacks like OCSP stapling.
What about a certificate signed for the correct hostname by a system trusted CA? (some apps are supposed to only trust a specific CA).That's a policy bug too, not an easily exploitable security bug (unless one of your system CAs is compromised). Does RedHat actually ship anything that does pinning?
That's a real world bug. Logic error "trust properly signed cert" vs. "trust specific CA signed cert".
These are all very common issues.Not nearly as common or exploitable as not checking the certificate at all, of which I've reported plenty of to RedHat and others over the past couple of years.
Uhm. Did you not look at any of the cve.mitre.org links I sent? These are incredibly common failures. Hint: if some class of bug has a bunch of CVE's you can multiply it by 100 or more for the number of affected real world cases (and that's in English software alone).
Michael
Anyways I think we're sufficiently off topic now. -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777, (continued)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Donald Stufft (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Tomas Hoger (Mar 05)