[Full-disclosure] Certificate spoofing issue with Mozilla, Konqueror, Safari 2

[Alexander Klink]

Hi,

On Sun, Nov 18, 2007 at 10:21:18PM +0100, Nils Toedtmann wrote:
>         DN="CN=www.example.com"
>         subjectAltName:dNSName=www.example.com
>         subjectAltName:dNSName=www.paypal.com
> 
>     and lures the user to https://www.example.com/. The user gets an
>     "unknown CA" warning, but the "subjectAltName:dNSName" extensions
>     are not shown to him, so the cert looks ok. As he does not plan to
This is particularly annoying as there is no way to actually view the
subjectAltNames in Mozilla (except for being able to translate the
hexdump in your head). At least they're planning to change the handling
of wildcards[0], so it is no longer enough to get that one certificate
with a subjectAltName of '*' installed.

Best regards,
    Alex

[0]: http://permalink.gmane.org/gmane.comp.mozilla.crypto/8429
-- 
Dipl.-Math. Alexander Klink | IT-Security Engineer |    a.klink at cynops.de
 mobile: +49 (0)178 2121703 |          Cynops GmbH | http://www.cynops.de
----------------------------+----------------------+---------------------
      HRB 7833, Amtsgericht | USt-Id: DE 213094986 |     Geschäftsführer:
     Bad Homburg v. d. Höhe |                      |      Martin Bartosch