search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Mozilla fails to validate the DN of X.509 certificates

Vulnerability Note VU#784278

Original Release Date: 2004-08-23 | Last Revised: 2004-08-25

Overview

Mozilla fails to verify that the Distinguished Name (DN) of an X.509 certificate is unique when importing it. A denial of service occurs when Mozilla imports a specially crafted, self-signed certificate that has the same DN as an existing Certificate Authority (CA) root certificate.

Description

Mozilla version 1.7.1 and earlier can import a self-signed certificate with the same DN as an existing CA root certificate. When this occurs, the imported certificate will override the CA root certificate. Mozilla will return an error when attempting to create a secure connection to a website whose certificate is signed by a CA root certificate that has been overridden in this manner. A remote attacker can automate exploitation of this vulnerability using the "application/x-x509-email-cert" MIME type. This will permit Mozilla to import the certificate without any user intervention.

Impact

A remote attacker could cause a denial of service against the certificate store, preventing the user from accessing SSL websites.

Solution

This issue has been resolved in the following versions:

Mozilla 1.7.2
Firefox 0.9.3
Thunderbird 0.7.3

For other Mozilla-based products, please check with your vendor for updates.

Vendor Information

784278
 
Affected   Unknown   Unaffected

Gentoo Linux

Updated:  August 24, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Mozilla

Updated:  August 23, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Mozilla bug 249004.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This was reported on the Mozilla Known Vulnerabilities List. Mozilla attributes this report to Marcel Boesch.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2004-0758
Severity Metric: 5.18
Date Public: 2004-06-29
Date First Published: 2004-08-23
Date Last Updated: 2004-08-25 14:10 UTC
Document Revision: 12

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.