[23730] in bugtraq
Re: AW: IE https certificate attack
daemon@ATHENA.MIT.EDU (Ben Laurie)
Mon Jan 7 04:28:12 2002
Message-ID: <3C38B2CE.69B250B3@algroup.co.uk>
Date: Sun, 06 Jan 2002 20:25:50 +0000
From: Ben Laurie <ben@algroup.co.uk>
MIME-Version: 1.0
To: K.J.Mueller@EnBW.com
Cc: venglin@freebsd.lublin.pl, security@e-matters.de,
bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
K.J.Mueller@EnBW.com wrote:
>
> Hi,
>
> could it be, that the text-browsers (lynx, links, w3m) don't even
> bother comparing the actual server name to the certificate's
> "issued for" entry?
>
> I just tested these and none complained:
>
> - lynx 2.8.5dev.2 (with OpenSSL 0.9.6a)
> - links 0.96
> - w3m 0.1.11-pre
> (all on Mandrake Linux 8.1)
>
> Neither did any of them complain when accessing a https web page
> with a self-made certificate.
They shouldn't complain about the server name (at least, not if its
right) with a self-made cert. However, they should complain about the
cert not using a trusted CA.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
