|Main Archive Page > Month Archives > oss-security archives|
* Jan Lieskovsky:
> 1, Network Security Services (NSS) handled wildcard (*) character
> in the Common Name field of a x509v3 digital certificate.
> If an attacker is able to get a carefully-crafted certificate,
> signed by a Certificate Authority trusted by Firefox, the attacker
> could use the certificate during the man-in-the-middle attack and
> potentially confuse Firefox into accepting it by mistake. Different
> vulnerability than CVE-2009-2408.
>  http://www.westpoint.ltd.uk/advisories/wp-10-0001.txt
>  http://bugs.gentoo.org/show_bug.cgi?id=335731
Is this really a _security_ bug? The CN was not validated by the CA,
so it's the CA's fault (which you have to trust, but still).