Date: Wed, 11 Mar 2015 22:43:56 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 On 03/11/2015 09:03 PM, Michael Samuel wrote: > Hi, > > On 12 March 2015 at 11:07, Kurt Seifried <kseifried@...hat.com> wrote: >>> You can test for the common bugs extremely easily - you need two types of >> >> If only it were so simple. Seriously, life would be awesome. >> >> What about expired certificates? >> What about certificates that are properly signed but not yet valid? > > Sure, you could test these too, but I'd argue these are policy issues, > not security bugs. If your SSL/TLS implementation accepts expired certs as being ok, then you have a problem. > Where is an attacker going to get the private key for an expired cert, > but be unable to > find the current one? By stealing it? Certificate revocation doesn't work. Otherwise we wouldn't have vendors shipping browser updates to invalidate known to be compromised certificates, we'd be relying on CRL/OCSP and not hacks like OCSP stapling. >> What about a certificate signed for the correct hostname by a system >> trusted CA? (some apps are supposed to only trust a specific CA). > > That's a policy bug too, not an easily exploitable security bug > (unless one of your > system CAs is compromised). Does RedHat actually ship anything that > does pinning? That's a real world bug. Logic error "trust properly signed cert" vs. "trust specific CA signed cert". >> These are all very common issues. > > Not nearly as common or exploitable as not checking the certificate at > all, of which I've > reported plenty of to RedHat and others over the past couple of years. Uhm. Did you not look at any of the cve.mitre.org links I sent? These are incredibly common failures. Hint: if some class of bug has a bunch of CVE's you can multiply it by 100 or more for the number of affected real world cases (and that's in English software alone). > Michael Anyways I think we're sufficiently off topic now. -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ