133995 - Possible to send encrypted mail using untrusted recipient certs

Status: VERIFIED FIXED

(MailNews Core :: Security: S/MIME, defect, P1)

Description

[Kai Engert (:KaiE:)]

Make sure you have a cert from someone else.
Edit the trust of the CA that signed the cert.
Compose a message to that person, choose "encrypted".
Open the "message security" info. You'll see that the dialog says "not trusted"
for the recipient cert.
Send the message.

Actual behaviour: Sending works.

Expected behaviour: Sending is blocked and an error message about the non
trusted cert is shown.

Comment 1

[Julien Pierre]

This seems serious enough to warrant fixing by RTM.

Comment 2

[Kai Engert (:KaiE:)]

taking, raising priority

Comment 3

[Kai Engert (:KaiE:)]

Stephane, Charles, today I said in our meeting, for fixing this bug we probably
need a new error message, but I do no longer think so. We can use the same error
message that is shown when there are no certs found at all, because that message
includes the information to check for valid recipient certs.

Comment 4

[Charles Rosendahl]

changed to ADT1 as this is a security hole.

Comment 5

[Kai Engert (:KaiE:)]

Attachment: Suggested Fix

Comment 6

[Javier Delgadillo]

Comment on attachment 86793 [details] [diff] [review]
Suggested Fix

r=javi

Comment 7

[selmer (gone)]

Other than manually editing the cert, how does one get into this situation?  Is
there any way that an attacker can cause this situation remotely?

This looks like a good patch to take since the code used to only require the
existence of the cert and now requires it to also be a good cert.

Comment 8

[Kai Engert (:KaiE:)]

> Other than manually editing the cert, how does one get into this situation?

A certificate can become invalid if it expires or if it gets revoked, and the
deployment uses "Certificate Revocation Lists". The application should not allow
to use revoked certificates.

I recommend to take the patch for the branch.

Comment 9

[Scott MacGregor]

Comment on attachment 86793 [details] [diff] [review]
Suggested Fix

sr=mscott

Comment 10

[Kai Engert (:KaiE:)]

Checked in to trunk.

Comment 11

[Charles Rosendahl]

Checked into trunk

Comment 12

[Charles Rosendahl]

Verified on 20020614 Trunk Builds.  Mark fixed1.0.1 when on the branch.

Also, when will the counterpart to this fix, bug 136445 be in?  Currently, If
the CA is not in the trusted list, a user cert will not verify and will not
therefore get added to the other people's tab.  I'll add further comments to bug
136445.

Comment 13

[Jaime Rodriguez, Jr.]

adt1.0.1+ (on ADT's behalf) approavl for checkin to the 1.0 branch, pending
Drivers' approval. pls check this in asap, then add the "fixed1.0.1" keyword.

Comment 14

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 15

[Kai Engert (:KaiE:)]

Checked in to 1_0 branch.

Comment 16

[Charles Rosendahl]

Verified on the 20020620 branch builds.