4 ms·

Bug 1135561 – developer.palm.com returns SSL 3.0 ServerHello for TLS ClientHello

30 points by yuhong 11y ago

sbierwagen 11y ago
Might tweak the title: the bug was in developer.palm.com, Firefox only exposed it first. Rather than fix the server, HP (current owner of Palm's assets) just shut it down.
- wyldfire 11y ago
  Indeed, it sounded as if the bugzilla page somehow had a hand in bringing down the palm site. Poor Yuhong Bao, probably not what he'd hoped for when he opened this bug. No good deed goes unpunished. :/
- dang 11y ago
  We changed the title from "The Mozilla Bugzilla bug that caused developer.palm.com to shutdown (2015)".
  - yuhong 11y ago
    Still misleading. This server responded to a TLS 1.0 ClientHello with a TLS 1.0 ServerHello. That is what I mean by "TLS >1.0".
yeukhon 11y ago
Why is this even on the front page? Such a minor issue to me.
- wyldfire 11y ago
  I think some of us HNers might fondly recall the Palm series and nostalgia is likely responsible for many an upvote.
  - yuhong 11y ago
    It was later used for webOS too before it was shut down.
Illniyar 11y ago
why is a bug in developer.palm.com opened in mozilla ? I think I'm missing some context here, what does the last comment mean: "I will remove this site from the whitelist in the next update."
- wyldfire 11y ago
  Refer to the product identified as having the bug: > Product: Tech Evangelism > For reporting web pages that need to be upgraded to support web standards and Gecko-based browsers. And for reporting add-ons that exhibit common problems that make Firefox run sub-optimally. It's not clear to me what the whitelist referred to is.
  - wtallis 11y ago
    Sounds to me like there is or was a list of important sites that were known to only support older versions of SSL/TLS that Firefox would otherwise refuse to connect to.
  - mcpherrinm 11y ago
    The whitelist was introduced here: https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbffaa https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbf... https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 It's described as "TLS Intolerance fallback whitelist". It seems to allow RC4 and SSL3
    - yuhong 11y ago
      Background: Servers are supposed to respond to ClientHellos indicating newer versions of SSL/TLS with a ServerHello indicating the latest version the server supports. However not all servers did that properly. Thus browsers used to fall back to ClientHellos indicating old TLS and SSLv3 versions to support them. In this case, this server incorrectly responded to ClientHellos indicating SSL/TLS versions other than 1.0 with a SSLv3 ServerHello!
yuhong 11y ago
Trivia: I took the email address from https://bugzilla.mozilla.org/show_bug.cgi?id=1154285 https://bugzilla.mozilla.org/show_bug.cgi?id=1154285

30 points by yuhong 11y ago

Might tweak the title: the bug was in developer.palm.com, Firefox only exposed it first. Rather than fix the server, HP (current owner of Palm's assets) just shut it down.

wyldfire 11y ago
Indeed, it sounded as if the bugzilla page somehow had a hand in bringing down the palm site. Poor Yuhong Bao, probably not what he'd hoped for when he opened this bug. No good deed goes unpunished. :/
dang 11y ago
We changed the title from "The Mozilla Bugzilla bug that caused developer.palm.com to shutdown (2015)".
- yuhong 11y ago
  Still misleading. This server responded to a TLS 1.0 ClientHello with a TLS 1.0 ServerHello. That is what I mean by "TLS >1.0".

yeukhon 11y ago

Why is this even on the front page? Such a minor issue to me.

wyldfire 11y ago
I think some of us HNers might fondly recall the Palm series and nostalgia is likely responsible for many an upvote.
- yuhong 11y ago
  It was later used for webOS too before it was shut down.

Illniyar 11y ago

why is a bug in developer.palm.com opened in mozilla ? I think I'm missing some context here, what does the last comment mean: "I will remove this site from the whitelist in the next update."

wyldfire 11y ago
Refer to the product identified as having the bug: > Product: Tech Evangelism > For reporting web pages that need to be upgraded to support web standards and Gecko-based browsers. And for reporting add-ons that exhibit common problems that make Firefox run sub-optimally. It's not clear to me what the whitelist referred to is.
- wtallis 11y ago
  Sounds to me like there is or was a list of important sites that were known to only support older versions of SSL/TLS that Firefox would otherwise refuse to connect to.
- mcpherrinm 11y ago
  The whitelist was introduced here: https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbffaa https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbf... https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 It's described as "TLS Intolerance fallback whitelist". It seems to allow RC4 and SSL3
  - yuhong 11y ago
    Background: Servers are supposed to respond to ClientHellos indicating newer versions of SSL/TLS with a ServerHello indicating the latest version the server supports. However not all servers did that properly. Thus browsers used to fall back to ClientHellos indicating old TLS and SSLv3 versions to support them. In this case, this server incorrectly responded to ClientHellos indicating SSL/TLS versions other than 1.0 with a SSLv3 ServerHello!

yuhong 11y ago

Trivia: I took the email address from https://bugzilla.mozilla.org/show_bug.cgi?id=1154285 https://bugzilla.mozilla.org/show_bug.cgi?id=1154285