On 2011-06-04 13:24:36 +0200, Vincent Lefevre wrote: > The bug is not normally visible now that the server side has been > fixed. But the security problem probably still exists. Anyway, how > the CA certificate is supposed to be accessed?
I confirm the security bug: the certificate is *not* checked. Here's what I did: 1. Install a web server with SSL support on my local machine, according to /usr/share/doc/apache2.2-common/README.Debian.gz # a2ensite default-ssl # a2enmod ssl # /etc/init.d/apache2 restart (I did nothing special concerning the certificates). 2. Configure the DNS system so that identi.ca corresponds to the local machine (where I installed the server), by adding 127.0.2.1 identi.ca to the /etc/hosts file. Now, if I try to open https://identi.ca/ with Iceweasel, I get an error because the certificate isn't valid, and /var/log/apache2/ssl_access.log doesn't show any access to the local server. This is fine! Iceweasel protects the user against attacks like DNS spoofing. Then, let's try with Gwibber: I've added an Identi.ca account and clicked on Authorize. Nothing happened on the Gwibber side, but /var/log/apache2/ssl_access.log shows a line: 127.0.0.1 - - [05/Jun/2011:00:23:57 +0200] "POST /api/oauth/request_token HTTP/1.1" 404 1623 "-" "Python-urllib/2.6" This is wrong! Here this isn't much a problem because my server doesn't do anything useful, but Gwibber is potentially vulnerable to man-in-the-middle attacks. -- Vincent Lefèvre <[email protected]> - Web: <http://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <http://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Arénaire project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
