5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.107 Low
EPSS
Percentile
95.0%
Mozilla fails to verify that the Distinguished Name (DN) of an X.509 certificate is unique when importing it. A denial of service occurs when Mozilla imports a specially crafted, self-signed certificate that has the same DN as an existing Certificate Authority (CA) root certificate.
Mozilla version 1.7.1 and earlier can import a self-signed certificate with the same DN as an existing CA root certificate. When this occurs, the imported certificate will override the CA root certificate. Mozilla will return an error when attempting to create a secure connection to a website whose certificate is signed by a CA root certificate that has been overridden in this manner. A remote attacker can automate exploitation of this vulnerability using the “application/x-x509-email-cert” MIME type. This will permit Mozilla to import the certificate without any user intervention.
A remote attacker could cause a denial of service against the certificate store, preventing the user from accessing SSL websites.
This issue has been resolved in the following versions:
Mozilla 1.7.2
Firefox 0.9.3
Thunderbird 0.7.3
For other Mozilla-based products, please check with your vendor for updates.
784278
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: August 24, 2004
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23784278 Feedback>).
Updated: August 23, 2004
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see Mozilla bug 249004.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23784278 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This was reported on the Mozilla Known Vulnerabilities List. Mozilla attributes this report to Marcel Boesch.
This document was written by Will Dormann.
CVE IDs: | CVE-2004-0758 |
---|---|
Severity Metric: | 5.18 Date Public: |