|The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.|
SSL: creating a fake certification authority
Synthesis of the vulnerability
An attacker, with important resources, can create a fake intermediary certification authority using a MD5 hash.
Impacted products: ASA, IOS Cisco, Cisco Router, Fedora, Notes, Maxthon, IE, Windows (platform) ~ not comprehensive, Firefox, SeaMonkey, Mozilla Suite, Netscape Navigator, Opera, RHEL, Unix (platform) ~ not comprehensive.
Creation date: 16/01/2009.
Identifiers: 17341, BID-33065, CSCsw88068, CSCsw90626, CVE-2004-2761, FEDORA-2009-1276, FEDORA-2009-1291, RHSA-2010:0837-01, RHSA-2010:0838-01, VIGILANCE-VUL-8401, VU#836068.
Description of the vulnerability
At the end of 2008 (VIGILANCE-ACTU-1377), using a cluster of 200 game consoles, researchers used a collision on MD5, to create a fake certification authority recognized by all browsers.
Here is a description of the attack:
- The attacker chooses a Certification Authority (CA) using MD5 signatures (RapidSSL, FreeSSL, TC TrustCenter AG, RSA Data Security, Thawte, verisign.co.jp).
- The attacker requests to this CA a certificate for a web site. This initial certificate is thus signed with MD5.
- The attacker alters this certificate to transform it to an Intermediary Certification Authority (IAC), and then uses a MD5 collision to ensure it has the same MD5 as the initial certificate.
- The attacker uses the IAC to generate a web site certificate (WS).
- The attacker setups a malicious web site, proposing certificates for the WS and the ACI.
- The victim connects to the web site. His web browser contains the root certificate of the CA, which authenticates the IAC and then the WS.
No error message is displayed in victim's browser, who can then trust attacker's web site.
Complete Vigil@nce bulletin.... (free trial)
Computer vulnerabilities tracking service
Vigil@nce provides a software vulnerability bulletin. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The technology watch team tracks security threats targeting the computer system.