Description
Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.mozilla.org/projects/security/known-vulnerabilities.html ↗
- http://www.novell.com/linux/security/advisories/2004_36_mozilla.html ↗
- http://www.redhat.com/support/errata/RHSA-2004-421.html ↗
- http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml ↗
- http://marc.info/?l=bugtraq&m=109900315219363&w=2 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3134 ↗
- http://www.securityfocus.com/bid/15495 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16706 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10304 ↗
- http://www.kb.cert.org/vuls/id/784278 ↗
- http://bugzilla.mozilla.org/show_bug.cgi?id=249004 ↗
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127186 ↗