152703 - Crash with Norton Internet Security 2002 and OCSP cert validation enabled

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P2)

Description

[Andrew McGregor]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.0) Gecko/20020530
BuildID:    2002053012

When Norton Internet Security 2002 is enabled with Ad Blocking, a crash occurs
when I attempt to login to sourceforge.net.  It gets halfway through rendering
the above URL and crashes.

Totally deleted my profile to rule out profile corruption.

Reproducible: Always
Steps to Reproduce:
1. Enable OCSP validation for certificates that support an OCSP service URL
2. Enable Norton Internet Security 2002 and enable Ad Blocking
3. Goto http://sourceforge.net and click on the "login with SSL" option (leave
the box checked)
4. Fill in login details and click "login" button

Actual Results:  Mozilla gets halfways throught rendering the page and crashes.

If you disable NIS2002 the following error message appears in a XUL dialog box:

"Error trying to validate certificate from sfads.osdn.com using OSCP - corrupted
or unknown response. Error code: -8073"

However the browser has to be restarted as it will not go to any other pages
after this error appears.

Expected Results:  
If you disable the OCSP validation option it works as expected - i.e. no crash.

Talkback IDs: TB7478961G, TB7478449X, TB7478217Y

Comment 1

[Mitchell Stoltz (not reading bugmail)]

->PSM. OCSP issue.

Comment 2

[Stephane Saux]

Kai.
We have several problems with OCSP.

Comment 3

[Stephane Saux]

Reporter can you take a nightly from the 1.0 branch? We landed an ocsp fix
recently, and I'd be interested to see if we get a different behavior.

Comment 4

[Andrew McGregor]

I'll download a nightly tonight and try it out - will update when I've tried it
again.

Comment 5

[Andrew McGregor]

Download Build ID: 2002062106

Mozilla does not crash this time.  When I log in it comes up with the following
error in a dialog box:

"Error trying to validate certificate from sfads.osdn.com using OSCP -
unauthorized request."

Again, the browser has to be restarted as it will not go to any other pages
after this error appears.

Hope this helps.

Comment 6

[John Unruh]

Marking works for me. What I'm seeing is the "unauthorized request" dialog box
when  logging into sourceforge security. After clicking OK, the warning appear
two more times. If I do not dismiss all of the dialogs, I cannot reach another
page, but if I click OK on all of the warnings, then I can continue to surf
without restarting the browser.

Comment 7

[John Unruh]

Verified works for me.