3 ms·

I feel like I'm missing some context here - they say applications are using the Mozilla root store "for purposes other than what Mozilla’s root store is curated

I feel like I'm missing some context here - they say applications are using the Mozilla root store "for purposes other than what Mozilla’s root store is curated for", but they never actually say what those purposes are. I wonder if they don't think it matters or if they're being deliberately secretive because there's an unpatched exploit floating around somewhere? That said, I can't come up with what somebody could be using a root store for besides validating a certificate.

cipherboy 6y ago
From the article, one use case they explicitly call out is code signing verification. Parties like Apple use x509/PKI certificates for code signing. A third-party application COULD use this trust DB for code signing verification. If an application is signed with a (root) cert trusted by this DB, it is allowed. Mozilla is saying woah: we only validate CA's TLS Server and S/MIME requirements (for CAs in our root DB). They don't validate that an arbitrary CA in their root DB has proper code signing certificate issuance procedures. So this theoretically application is in the wrong and they consider it a high severity vulnerability. But I agree, there's an open question about _who_ is using the DB this way.
agwa 6y ago
"Purpose" refers to the type of certificate, e.g. SSL/TLS certificate, S/MIME certificate, code signing certificate. Some roots in Mozilla's store are trusted for TLS only, some for S/MIME only, and some for both. The blog post is about applications which are using Mozilla's root store to verify certificates which are for a different purpose than the root is trusted for. For example, NuGet uses Mozilla's root store to verify code signing certificates, which is obviously wrong because none of the roots in Mozilla's store are trusted for the purpose of code signing: https://github.com/NuGet/Announcements/issues/56 https://github.com/NuGet/Announcements/issues/56
FateOfNations 6y ago
There likely is an unpatched exploit that Mozilla is aware of but isn't disclosing (to the public). I'd hazard a guess it's more related to blindly parsing the root store and trusting the certs that Mozilla has in there specifically for the purpose of not trusting them (DigiNotar, et. al).

cipherboy 6y ago

From the article, one use case they explicitly call out is code signing verification. Parties like Apple use x509/PKI certificates for code signing. A third-party application COULD use this trust DB for code signing verification. If an application is signed with a (root) cert trusted by this DB, it is allowed. Mozilla is saying woah: we only validate CA's TLS Server and S/MIME requirements (for CAs in our root DB). They don't validate that an arbitrary CA in their root DB has proper code signing certificate issuance procedures. So this theoretically application is in the wrong and they consider it a high severity vulnerability. But I agree, there's an open question about _who_ is using the DB this way.

agwa 6y ago

"Purpose" refers to the type of certificate, e.g. SSL/TLS certificate, S/MIME certificate, code signing certificate. Some roots in Mozilla's store are trusted for TLS only, some for S/MIME only, and some for both. The blog post is about applications which are using Mozilla's root store to verify certificates which are for a different purpose than the root is trusted for. For example, NuGet uses Mozilla's root store to verify code signing certificates, which is obviously wrong because none of the roots in Mozilla's store are trusted for the purpose of code signing: https://github.com/NuGet/Announcements/issues/56 https://github.com/NuGet/Announcements/issues/56

FateOfNations 6y ago

There likely is an unpatched exploit that Mozilla is aware of but isn't disclosing (to the public). I'd hazard a guess it's more related to blindly parsing the root store and trusting the certs that Mozilla has in there specifically for the purpose of not trusting them (DigiNotar, et. al).