Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

At DEFCON 17 (2009) Moxie Marlinspike gave a talk were he was able to use a malformed certificate signing request to get SSL certs signed for domains he doesn't own. The gist of it was that for the common name put something like www.bank.com\0.iownthisdomain.com with \0 being a null byte.

Is this attack still generally possible, of course you can probably find CAs that are still vulnerable but are the clients, particularly Microsoft's SSL stack?

share|improve this question
    
Ok. So Windows, Outlook etc. is ok. But what about Mac OSX ? Linux? –  theking2 Nov 19 '13 at 20:12

1 Answer 1

up vote 6 down vote accepted

Microsoft has issued the MS09-056 update which patched this vulnerability in CryptoAPI on almost all of their operating systems, that automatically fixes it for Internet Explorer, Chrome, Safari, and any other application that relies on the CryptoAPI. Mozilla has issued an updated quickly after Marlinspike's demonstration and Opera has patched it in version 10.00

share|improve this answer
    
Great answer thank you –  David Jul 4 '13 at 18:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.