Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At DEFCON 17 (2009) Moxie Marlinspike gave a talk were he was able to use a malformed certificate signing request to get SSL certs signed for domains he doesn't own. The gist of it was that for the common name put something like\ with \0 being a null byte.

Is this attack still generally possible, of course you can probably find CAs that are still vulnerable but are the clients, particularly Microsoft's SSL stack?

share|improve this question
Ok. So Windows, Outlook etc. is ok. But what about Mac OSX ? Linux? – theking2 Nov 19 '13 at 20:12
up vote 7 down vote accepted

Microsoft has issued the MS09-056 update which patched this vulnerability in CryptoAPI on almost all of their operating systems, that automatically fixes it for Internet Explorer, Chrome, Safari, and any other application that relies on the CryptoAPI. Mozilla has issued an updated quickly after Marlinspike's demonstration and Opera has patched it in version 10.00

share|improve this answer
Great answer thank you – David Jul 4 '13 at 18:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.