IE and Konqueror Bug Makes SSL Insecure

Spad writes "The Register reports that IE and Konqueror both have a bug that allows anyone with a legit Verisign SSL certificate to issue a 'legit' certificate for a 3rd party site. IE and Konqueror don't both to check the issuer of this intermediate cert making SSL in both browsers something of a joke". Update by Hetz: if you're using KDE from CVS, the fix is inside or you can wait to next week for KDE 3.0.3 (which will have more fixes for KDE 3.0). Thanks to Waldo bastian for the blazing fast fix (95 minutes since it was reported).

Comments

Whoah...

[Anonvmous Coward]

... you mean Linux isn't 100% secure? How humbling!

Re:Security.

[doofusclam]

And here I am on Slashdot, assuming that a topic which shows vulnerabilities in both Konqueror and IE would refrain from the IE bashing, or maybe bash both?

But no some dumbass comes out and says something stupid anyway. You gonna bash Konqueror now??

I blame Verisign.

[h4mmer5tein]

Hmmmm, Identical bugs in IE and Konquerer. No chance of their being shared code involved so it must be down to implementation. What determines the implementation of a protocol? The API, as defined by Verisign who developed it in the first place. My guess is that this is Verisigns stuff up in incorectly specifying the protocol for handling certificates. IE and Konquerer were both written in accordance with Verisigns protocol and so both end up with the same bug.

Well I see /. says a "fix" is available now...

[gamorck]

if you're using KDE from CVS, the fix is inside or you can wait to next week for KDE 3.0.3 (which will have more fixes for KDE 3.0). Thanks to Waldo bastian for the blazing fast fix (95 minutes since it was reported). I wonder when MS will release a fix.

Considering it takes an entire afternoon to compile KDE 3 I'm pretty sure that ZERO testing went into this so called fix. Wow what a great job by the Open Source community. Its bad when MS releases a Service Pack that BSODs your box, but its okay when some developer without half a brain uploads a fix that he obviously didnt even bother to test. The funny part is that its in CVS and that means about 0.00001 % of all KDE users are going to upgrade to it before there is an official release. Somebody please point out the easy to install hotfix binary so I dont have to redownload and recompile the entire KDE suite. Ooppps! I guess ya can't can you? I guess that means that for all intensive purposes neither MS or KDE have a widely available fix for this yet. Another victory for Open Source! J