Peer-trusted certs can use alt names to spoof — Mozilla

2008-07-0100:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:P/A:P

EPSS

0.012

Percentile

85.1%

JSON

Mozilla developer John G. Myers reported a weakness in the trust model used by Mozilla regarding alternate names on self-signed certificates (and those with mismatched names) that if accepted could be used to spoof a secure connection to any other site. This problem was independently reported by Frank Benkstein and Nils Toedtmann.

Affected configurations

Vulners

Node

mozillafirefoxRange<2.0.0.15

mozillaseamonkeyRange<1.1.10

mozillathunderbirdRange<2.0.0.16

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
mozillathunderbird*cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::
mozilla	thunderbird	*	cpe:2.3:a:mozilla:thunderbird::::::::