FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mozilla -- built-in CA certificates may be overridden

Affected packages
firefox < 0.9.3
linux-mozilla < 1.7.2
linux-mozilla-devel < 1.7.2
mozilla < 1.7.2,2
1.8.a,2 <= mozilla
mozilla-gtk1 < 1.7.2

Details

VuXML ID 8d823883-0ca9-11d9-8a8a-000c41e2cdad
Discovery 2004-06-29
Entry 2004-09-22

Under some situations, Mozilla will automatically import a certificate from an email message or web site. This behavior can be used as a denial-of-service attack: if the certificate has a distinguished name (DN) identical to one of the built-in Certificate Authorities (CAs), then Mozilla will no longer be able to certify sites with certificates issued from that CA.

References

CERT/CC Vulnerability Note 160360
CVE Name CVE-2004-0758
URL http://banquo.inf.ethz.ch:8080/
URL https://bugzilla.mozilla.org/show_bug.cgi?id=249004