{"id":61,"date":"2003-05-12T19:12:51","date_gmt":"2003-05-12T12:12:51","guid":{"rendered":""},"modified":"2003-05-12T19:12:51","modified_gmt":"2003-05-12T12:12:51","slug":"more-details-on-safari-ssl-bug","status":"publish","type":"post","link":"https:\/\/deepquest.code511.com\/blog\/2003\/05\/more-details-on-safari-ssl-bug\/","title":{"rendered":"more details on Safari SSL bug"},"content":{"rendered":"<p>Apple&#8217;s Safari web browser does not validate the Common Name (CN) field on X.509 certificates that are downloaded to the client at the start of SSL\/TLS sessions.<!--more--><\/p>\n<p>here is more details from  Simson L. Garfinkel&#8217;s original post:<\/p>\n<p>Problem: Multiple Web Browsers do not do not validate CN on certificates.<\/p>\n<p>Effected Versons:<br \/>\n  Safari 1.0 Beta (v60)<br \/>\n  Safari 1.0 Beta 2 (v73)<br \/>\n  Konqueror Embedded (unknown version; common browser on Open Zaurus)<br \/>\n  [NOTE: Konquror 3.0.5 does not exhibit the problem.]<\/p>\n<p>Both versions of Safari were tested on MacOS 10.2.5 and 10.2.6.<\/p>\n<p>While doing work for an article on PKI, Jesse Burns and I discovered<br \/>\nthat Apple&#8217;s Safari web browser does not validate the Common Name (CN)<br \/>\nfield on X.509 certificates that are downloaded to the client at the<br \/>\nstart of SSL\/TLS sessions. This bug is particularly annoying because<br \/>\nthere is no way that we can find inside Safari to view the contents of<br \/>\na certificate; double-clicking on the &#8220;lock&#8221; icon does nothing.<\/p>\n<p>We are divided on whether or not this is a serious bug: Jesse feels<br \/>\nthat it is sufficient reason that people should stop using<br \/>\nSafari until it is fixed. Simson feels that PKI has been deployed so poorly and is so<br \/>\nmeaningless that it really doesn&#8217;t matter if Safari validates<br \/>\ncertificiates or not. <\/p>\n<p>Test vectors:<br \/>\n     1. [url=https:\/\/www.sandstorm.net\/]https:\/\/www.sandstorm.net\/[\/url]<br \/>\n     2. [url=https:\/\/bugreporter.apple.com\/]https:\/\/bugreporter.apple.com\/[\/url]<\/p>\n<p>Regarding Test Vector #1: <\/p>\n<p>Sandstorm&#8217;s home page is web-hosted at Vineyard.NET, a small ISP on<br \/>\nMartha&#8217;s Vineyard. Because Vineyard.NET multi-homes its clients, the<br \/>\nIP address 204.17.195.91 is shared by both [url=http:\/\/www.sandstorm.net]www.sandstorm.net[\/url] and<br \/>\nVineyard.NET&#8217;s administrative server, [url=http:\/\/www.vineyard.net]www.vineyard.net[\/url] However,<br \/>\nbecause VIneyard.NET has enabled SSL only for its own internal use and<br \/>\nnot for its customers, 204.17.195.91:443 points to [url=http:\/\/www.vineyard.net,]www.vineyard.net,[\/url]<br \/>\nand the certficiate at 204.17.195.91:443 is Vineyard.NET&#8217;s.<\/p>\n<p>Regarding Test Vector #2:<\/p>\n<p>A &#8220;GET \/&#8221; at [url=https:\/\/bugreporter.apple.com\/]https:\/\/bugreporter.apple.com\/[\/url] retrieves a JavaScript<br \/>\ndocument that executes the following:<\/p>\n<p><!--\n function time() {\n setTimeout(\"window.location.replace('https:\/\/bugreport.apple.com\/cgi-bin\/WebObjects\/RadarWeb.woa')\",10)\n }\n\nThis does a second GET at a new domain; the certificate at\n[url=https:\/\/bugreporter.apple.com\/]https:\/\/bugreporter.apple.com\/[\/url] actually has the common name of\nbugreport.apple.com.\n\n\n\nInternet Explorer 5.2.2 (5010.1) on MacOS did not exhibit the problem;\nit reported that the common name on the certificate did not match the\nentered DNS address with both of the two test vectors. The same\nbehavior was seen with Internet Explorer 5.5 on Windows. The same\nbehavior was seen with Opera 7.10 on Windows.\n\n\nApple Computer has been been notified of this bug.\n\nSimson L. Garfinkel         Jesse Burns\nMIT Laboratory for Computer Science       [email]jesse@ex.com[\/email]\n[email]simsong@lcs.mit.edu[\/email]\n\n\n\nHere is the full [url=http:\/\/www.sandstorm.net]www.sandstorm.net[\/url] certificate:\n\n[simsong@r2 scan] 346 % openssl s_client -connect [url=http:\/\/www.sandstorm.net:443]www.sandstorm.net:443[\/url]\nCONNECTED(00000003)\ndepth=0 \/C=US\/ST=Massachusetts\/L=Vineyard Haven\/O=Vineyard.NET, Inc.\/OU=Terms of use at [url=http:\/\/www.verisign.com\/rpa]www.verisign.com\/rpa[\/url] (c)00\/CN=www.vineyard.net\nverify error:num=20:unable to get local issuer certificate\nverify return:1\ndepth=0 \/C=US\/ST=Massachusetts\/L=Vineyard Haven\/O=Vineyard.NET, Inc.\/OU=Terms of use at [url=http:\/\/www.verisign.com\/rpa]www.verisign.com\/rpa[\/url] (c)00\/CN=www.vineyard.net\nverify error:num=27:certificate not trusted\nverify return:1\ndepth=0 \/C=US\/ST=Massachusetts\/L=Vineyard Haven\/O=Vineyard.NET, Inc.\/OU=Terms of use at [url=http:\/\/www.verisign.com\/rpa]www.verisign.com\/rpa[\/url] (c)00\/CN=www.vineyard.net\nverify error:num=21:unable to verify the first certificate\nverify return:1\n---\nCertificate chain\n 0 s:\/C=US\/ST=Massachusetts\/L=Vineyard Haven\/O=Vineyard.NET, Inc.\/OU=Terms of use at [url=http:\/\/www.verisign.com\/rpa]www.verisign.com\/rpa[\/url] (c)00\/CN=www.vineyard.net\n   i:\/C=US\/O=RSA Data Security, Inc.\/OU=Secure Server Certification Authority\n---\nServer certificate\n-----BEGIN CERTIFICATE-----\nMIIDnjCCAwugAwIBAgIQHyalcXUsMbWBPlciU6wzLDANBgkqhkiG9w0BAQUFADBf\nMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXUlNBIERhdGEgU2VjdXJpdHksIEluYy4x\nLjAsBgNVBAsTJVNlY3VyZSBTZXJ2ZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw\nHhcNMDIwNTE2MDAwMDAwWhcNMDMwNTIxMjM1OTU5WjCBqzELMAkGA1UEBhMCVVMx\nFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxFzAVBgNVBAcUDlZpbmV5YXJkIEhhdmVu\nMRswGQYDVQQKFBJWaW5leWFyZC5ORVQsIEluYy4xMzAxBgNVBAsUKlRlcm1zIG9m\nIHVzZSBhdCB3d3cudmVyaXNpZ24uY29tL3JwYSAoYykwMDEZMBcGA1UEAxQQd3d3\nLnZpbmV5YXJkLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA9YUotSBh\nTN3F4S2+TahP7F98\/M+Cp0hMPaxX47sZXdg6fhr61ibVaRKgs9E27bCD1jh7ccqv\nbTf5h9Mrf89FO7CAadJH49B\/H28hvWLhqQYhInO52iCTl80AwGaYJqrdIIrkDEg1\nVd5DEkdcNeBvj88lPpnQU7fNV9GwkFY\/SlMCAwEAAaOCARAwggEMMAkGA1UdEwQC\nMAAwCwYDVR0PBAQDAgWgMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwudmVy\naXNpZ24uY29tL1JTQVNlY3VyZVNlcnZlci5jcmwwRAYDVR0gBD0wOzA5BgtghkgB\nhvhFAQcXAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20v\ncnBhMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAZBgpghkgBhvhFAQYP\nBAsWCTgzNjc2MDI1NjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6\nLy9vY3NwLnZlcmlzaWduLmNvbTANBgkqhkiG9w0BAQUFAAN+AA4ve\/eHVmuL\/nZO\naJZ50O4QDrbot146DvQFLre1AUy9TjFEQw0wj3j\/qEAToNPZjcx55ADGWqukJMt4\nP5IDu6402J82bAQ1TrUF\/+JUARUpBUX18SNk7DsPXjvM7NK0sclb6BEq0sHNujd1\nAJzRaAHaBKQRsDEJCGxAyFsf\n-----END CERTIFICATE-----\nsubject=\/C=US\/ST=Massachusetts\/L=Vineyard Haven\/O=Vineyard.NET, Inc.\/OU=Terms of use at [url=http:\/\/www.verisign.com\/rpa]www.verisign.com\/rpa[\/url] (c)00\/CN=www.vineyard.net\nissuer=\/C=US\/O=RSA Data Security, Inc.\/OU=Secure Server Certification Authority\n---\nNo client certificate CA names sent\n---\nSSL handshake has read 1454 bytes and written 314 bytes\n---\nNew, TLSv1\/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA\nServer public key is 1024 bit\nSSL-Session:\n    Protocol  : TLSv1\n    Cipher    : EDH-RSA-DES-CBC3-SHA\n    Session-ID: \n    Session-ID-ctx: \n    Master-Key: 4AD7B59E9D9D3E8953B17B293153A7D104C6CC023E7EC5877FFCAB5D9DD16695F8E867C47D5A656842A352E3EB568F8C\n    Key-Arg   : None\n    Start Time: 1052273380\n    Timeout   : 300 (sec)\n    Verify return code: 21 (unable to verify the first certificate)\n---\n^C\n<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We recently posted a message about ssl bug affecting safari.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[3],"tags":[],"class_list":["post-61","post","type-post","status-publish","format-standard","hentry","category-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-Z","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/61","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=61"}],"version-history":[{"count":0,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/61\/revisions"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=61"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=61"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=61"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}