162763 - CERT_DecodeBasicConstraintValue fails with empty basic constraints

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Comment 1

[Julien Pierre]

Attachment: patch to use quick DER decoder for basic constraints

Comment 2

[Julien Pierre]

This was resolved when the large checkin for quickder went in yesterday, as part
of fix for bug #160805.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

wtc et al, are you OK with making this bug public? Looks like it wasn't really
an exploit anyway, but please confirm.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

There's no exploit here.  NSS rejects certs with pointless (empty) 
basicConstraints extensions.  No crash, no exploit.  I see no reason for
this to be "security sensitive".

Comment 5

[Julien Pierre]

The IP address with the test exploit for IE given was given to us privately and
was not supposed to be made public, but I was unware of that when I posted the
bug. This is why it was made security sensitive.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Since there is no exploit here, how is this IP address security sensitive?

Comment 7

[Julien Pierre]

That IP address isn't one of ours. Somebody outside of Netscape setup a test
system to reproduce the IE exploit, but intended only for us to be aware of that
address, not the world.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

We need to expunge that confidential IP address or else remove this bug from the
database; it can't stay security-sensitive.

Comment 9

[Julien Pierre]

I would say delete it . I don't know how to do that, though.