Closed Bug 222439 Opened 21 years ago Closed 21 years ago

Mails signed with Certificates which use Extensions / Policies will crash the Client

Categories

(MailNews Core :: Security: S/MIME, defect)

Other Branch
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED INVALID

People

(Reporter: r.gawanka, Assigned: nelson)

Details

Attachments

(1 file)

User-Agent: Opera/6.02 (Windows NT 4.0; U) [en] Build Identifier: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.4) Gecko/20030624 Mails signed with certificates (genereated by openssl), which use certificate extensions / policies - can not be validated with mozilla - the client will simple crash while trying to open the mail. This behavior is similar to the old Netscape 4.7x - he is also not able to verify this message and will simply crash. When you try to import such certificate to your own PSE within Mozilla, it will simply say "That certificate is already installed" - which is simply not true, Netscape 4.7 will just crash will trying to import. Other Clients, like Lotus Notes R5 / R6 or TrustNet Mail Secure are able to verify such messages, also openssl is able to verify such messages. Attached is the textual output from such certificate : openssl x509 -in x509_rga.var.dev_public_key.pem -text Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: md5WithRSAEncryption Issuer: C=DE, ST=Berlin, L=Berlin, O=rga.var.dev new Test, OU=Development, CN=rga.var.dev self signed test certificate/Email=securemail@rga.var.dev Validity Not Before: Oct 12 10:01:31 2003 GMT Not After : Nov 26 10:01:31 2003 GMT Subject: C=DE, ST=Berlin, L=Berlin, O=rga.var.dev new Test, OU=Development, CN=rga.var.dev self signed test certificate/Email=securemail@rga.var.dev Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:e2:47:b5:c1:73:2a:8e:57:24:9d:80:7d:ac:ba: c9:fb:59:90:b6:e3:fd:90:88:84:65:f7:80:34:e9: 06:8f:61:5a:f3:99:9f:74:d0:08:02:73:4e:93:e6: 64:63:df:72:d3:9b:a4:85:d6:25:b9:ba:58:1e:bf: d0:dd:78:75:81:92:1a:a2:16:85:b9:4e:c4:f4:26: c5:de:2e:fb:17:68:3f:51:26:61:90:a2:3e:04:d3: 47:a5:bd:0d:56:32:92:ac:1b:81:2c:d7:d5:28:a2: 81:35:18:96:3b:68:ee:9e:83:e8:ea:72:2c:7e:09: 0f:cf:10:57:fa:f6:b1:8c:bb Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Certificate Policies: critical 0X0V..+.....!..0I0G..+.......0;.9Attention! T/bone self signed test certificate - insecure X509v3 Basic Constraints: critical CA:FALSE, pathlen:1 Signature Algorithm: md5WithRSAEncryption 14:0b:9f:c9:91:0e:65:59:e7:ba:21:0f:6a:c4:38:9d:c8:f7: 87:ce:b2:ad:8f:74:d2:70:2a:65:f9:5e:f8:89:9e:f9:ba:13: be:50:6d:40:b7:a7:5e:1b:68:05:f9:1d:49:ea:48:c5:54:5c: fc:7d:7e:64:ec:63:70:e7:ab:02:a6:38:19:05:97:3d:59:a8: 78:0c:ef:31:1b:c4:0d:78:62:24:8f:59:06:81:2c:a1:46:d2: 44:8b:6a:ef:e8:44:9c:bb:8c:43:86:d3:c8:52:38:57:a7:cd: db:2b:4e:55:98:b0:87:77:da:a0:eb:b4:04:93:e5:c2:78:41: 64:a0 -----BEGIN CERTIFICATE----- MIIDbTCCAtagAwIBAgIBADANBgkqhkiG9w0BAQQFADCBvjELMAkGA1UEBhMCREUx DzANBgNVBAgTBkJlcmxpbjEPMA0GA1UEBxMGQmVybGluMR0wGwYDVQQKExRyZ2Eu dmFyLmRldiBuZXcgVGVzdDEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxMTAvBgNVBAMT KHJnYS52YXIuZGV2IHNlbGYgc2lnbmVkIHRlc3QgY2VydGlmaWNhdGUxJTAjBgkq hkiG9w0BCQEWFnNlY3VyZW1haWxAcmdhLnZhci5kZXYwHhcNMDMxMDEyMTAwMTMx WhcNMDMxMTI2MTAwMTMxWjCBvjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJlcmxp bjEPMA0GA1UEBxMGQmVybGluMR0wGwYDVQQKExRyZ2EudmFyLmRldiBuZXcgVGVz dDEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxMTAvBgNVBAMTKHJnYS52YXIuZGV2IHNl bGYgc2lnbmVkIHRlc3QgY2VydGlmaWNhdGUxJTAjBgkqhkiG9w0BCQEWFnNlY3Vy ZW1haWxAcmdhLnZhci5kZXYwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOJH tcFzKo5XJJ2Afay6yftZkLbj/ZCIhGX3gDTpBo9hWvOZn3TQCAJzTpPmZGPfctOb pIXWJbm6WB6/0N14dYGSGqIWhblOxPQmxd4u+xdoP1EmYZCiPgTTR6W9DVYykqwb gSzX1SiigTUYljto7p6D6OpyLH4JD88QV/r2sYy7AgMBAAGjeTB3MGQGA1UdIAEB /wRaMFgwVgYJKwYBBAHKIQQBMEkwRwYIKwYBBQUHAgIwOxY5QXR0ZW50aW9uISBU L2JvbmUgc2VsZiBzaWduZWQgdGVzdCBjZXJ0aWZpY2F0ZSAtIGluc2VjdXJlMA8G A1UdEwEB/wQFMAMCAQEwDQYJKoZIhvcNAQEEBQADgYEAFAufyZEOZVnnuiEPasQ4 ncj3h86yrY900nAqZfle+Ime+boTvlBtQLenXhtoBfkdSepIxVRc/H1+ZOxjcOerA AqY4GQWXPVmoeAzvMRvEDXhiJI9ZBoEsoUbSRItq7+hEnLuMQ4bTyFI4V6fN2ytO VZiwh3faoOu0BJPlwnhBZKA= -----END CERTIFICATE----- The following extensions were added while generating that certificate : [ extension_section ] certificatePolicies = critical,DER:30:58:30:56:06:09:2B:06:01:04:01:CA:21:04:01:30:49:30:47:06:08:2B:06:01:05:05:07:02:02:30:3B:16:39:41:74:74:65:6e:74:69:6f:6e:21:20:54:2f:62:6f:6e:65:20:73:65:6c:66:20:73:69:67:6e:65:64:20:74:65:73:74:20:63:65:72:74:69:66:69:63:61:74:65:20:2d:20:69:6e:73:65:63:75:72:65 basicConstraints=critical,CA:FALSE,pathlen:1 Here is an example email, signed with this test certificate : Message-ID: <TBoneMsgId%rga.var.dev%3F8EB2E3.4E39048%rga.var.dev%r.gawanka@rga.var.dev> Date: Thu, 16 Oct 2003 17:01:55 +0200 From: =?ISO-8859-1?Q?Ren=E9_Gawanka?= <securemail@rga.var.dev> To: r.gawanka@bonelabs.com Subject: signed test mail MIME-Version: 1.0 Content-Disposition: attachment; filename="smime.p7m" Content-Type: application/x-pkcs7-mime; name="smime.p7m" Content-Transfer-Encoding: base64 MIIGbgYJKoZIhvcNAQcCoIIGXzCCBlsCAQExCzAJBgUrDgMCGgUAMIGwBgkqhkiG 9w0BBwGggaIEgZ9Db250ZW50LVR5cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9dXMt YXNjaWkNCkNvbnRlbnQtVHJhbnNmZXItRW5jb2Rpbmc6IDdiaXQNCg0KVGhpcyBt ZXNzYWdlIGlzIHNpZ25lZCB3aXRoIGEgY2VydGlmaWNhdGUgd2hpY2ggdXNlcyBj ZXJ0aWZpY2F0ZQ0KZXh0ZW5zaW9ucw0KDQqgggNxMIIDbTCCAtagAwIBAgIBADAN BgkqhkiG9w0BAQQFADCBvjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJlcmxpbjEP MA0GA1UEBxMGQmVybGluMR0wGwYDVQQKExRyZ2EudmFyLmRldiBuZXcgVGVzdDEU MBIGA1UECxMLRGV2ZWxvcG1lbnQxMTAvBgNVBAMTKHJnYS52YXIuZGV2IHNlbGYg c2lnbmVkIHRlc3QgY2VydGlmaWNhdGUxJTAjBgkqhkiG9w0BCQEWFnNlY3VyZW1h aWxAcmdhLnZhci5kZXYwHhcNMDMxMDEyMTAwMTMxWhcNMDMxMTI2MTAwMTMxWjCB vjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJlcmxpbjEPMA0GA1UEBxMGQmVybGlu MR0wGwYDVQQKExRyZ2EudmFyLmRldiBuZXcgVGVzdDEUMBIGA1UECxMLRGV2ZWxv cG1lbnQxMTAvBgNVBAMTKHJnYS52YXIuZGV2IHNlbGYgc2lnbmVkIHRlc3QgY2Vy dGlmaWNhdGUxJTAjBgkqhkiG9w0BCQEWFnNlY3VyZW1haWxAcmdhLnZhci5kZXYw gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOJHtcFzKo5XJJ2Afay6yftZkLbj /ZCIhGX3gDTpBo9hWvOZn3TQCAJzTpPmZGPfctObpIXWJbm6WB6/0N14dYGSGqIW hblOxPQmxd4u+xdoP1EmYZCiPgTTR6W9DVYykqwbgSzX1SiigTUYljto7p6D6Opy LH4JD88QV/r2sYy7AgMBAAGjeTB3MGQGA1UdIAEB/wRaMFgwVgYJKwYBBAHKIQQB MEkwRwYIKwYBBQUHAgIwOxY5QXR0ZW50aW9uISBUL2JvbmUgc2VsZiBzaWduZWQg dGVzdCBjZXJ0aWZpY2F0ZSAtIGluc2VjdXJlMA8GA1UdEwEB/wQFMAMCAQEwDQYJ KoZIhvcNAQEEBQADgYEAFAufyZEOZVnnuiEPasQ4ncj3h86yrY900nAqZfle+Ime +boTvlBtQLenXhtoBfkdSepIxVRc/H1+ZOxjcOerAqY4GQWXPVmoeAzvMRvEDXhi JI9ZBoEsoUbSRItq7+hEnLuMQ4bTyFI4V6fN2ytOVZiwh3faoOu0BJPlwnhBZKAx ggIfMIICGwIBATCBxDCBvjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJlcmxpbjEP MA0GA1UEBxMGQmVybGluMR0wGwYDVQQKExRyZ2EudmFyLmRldiBuZXcgVGVzdDEU MBIGA1UECxMLRGV2ZWxvcG1lbnQxMTAvBgNVBAMTKHJnYS52YXIuZGV2IHNlbGYg c2lnbmVkIHRlc3QgY2VydGlmaWNhdGUxJTAjBgkqhkiG9w0BCQEWFnNlY3VyZW1h aWxAcmdhLnZhci5kZXYCAQAwCQYFKw4DAhoFAKCBsTAYBgkqhkiG9w0BCQMxCwYJ KoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wMzEwMTIxMDE1NDNaMCMGCSqGSIb3 DQEJBDEWBBQCvhHpkajDEEfT8n9b9NXgA9XODDBSBgkqhkiG9w0BCQ8xRTBDMAoG CCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMC BzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASBgBsfM4jzeoUrnGrsgpzr rw8QvimYpHRoddusg1Rgh2acJDV5DCrwxHnBHpaerIfv2mTUjaEO1fwlknB6hJ71 4rzf38lyhDKB8k0wkT4LMcKfQx2CveLL7rj9opSFv2BGfdWUsX0AyNrgggpxG0bG JEqO9Y/uB9SsiKj/q24wxF1W Reproducible: Always Steps to Reproduce: 1. Receive any signed mail, which are signed with certificates that use extensions 2. Try to open the mail Actual Results: Mozilla will crash while verifying Expected Results: Verify the message, [and do not crash :D]
I wonder why this still isnt recognized, maybe this has something todo with the Vulnerbilities within ASN.1 (http://www.uniras.gov.uk/vuls/2003/006489/smime.htm)
Nelson, please take a look at this bug. Rene, could you see if the latest Mozilla (1.7a development) nightly build crashes while trying to open the mail?
Assignee: ssaux → MisterSSL
The above message looks to me like the output of blat. I cannot reproduce this crash using the current trunk NSS builds. I put the above message in a mozilla folder, and read it with mozilla. mozilla did not crash. It showed the following text: This message is signed with a certificate which uses certificate extensions and showed an invalid signature (broken pen icon).
Well, to be sure i create again a new test cert and send a new mail, the result in the 1.4 Client was the same - instant crash. After that i installed the nightly build (1.7a) - this time the client didnt crash but the message had an error with the digital signature for unknown reason (1028). Furthermore, i tried to install the p12 file (already attached in this bug) into mozilla and i was unable to do so - it always said "The certificate and private key already exists on that security device" which is simply not true - i have not a single cert installed. While the crashing seems to be fixed, a few problems remain : - Message shown as invalid for unknown reason - cant view the certificate which signed the message - cant install certificates with policy extensions into mozilla
Sorry just forgot - other clients like lotus notes only say the cert which signed the message is not trusted, but the message itself seems legit.
You've asserted here that the policy extension causes problems, but you haven't offered evidence that the policy extension is actually the cause. Can you demonstrate that by simply removing that policy extension (and making no other changes), that all the rest works as expected?
Rene, I was recently meeting the problem that a given signed message would crash Mozilla. It appeared that with a fresh profile this would not happen. The fact such a thing can happen is still a problem, but it got much lower on my priority radar. It seems to me not unlikely that something got broken in your profile after experimenting, and that it would be definitively useful if you could verify first if you actualy can reproduce this with a fresh new profile.
This bug reports that mozilla crashes when it encounters a cert with the particular critical policy extension used in the example cert, above. I think we have demonstrated that NSS 3.9 does not crash when it encounters such certs. So, I think this bug is invalid. Reporter: Agree? NSS does not understand Certificate Policy extensions. When NSS encounters a cert with a CRITICAL Certificate Policy extension, NSS rejects the cert completely, as required by RFC 3280, page 30, section 4.2.2.5, paragraph 3. When the extension is present, but not critical, NSS accepts the cert (assuming there are no other issues with it). NSS's lack of understanding of Certificate Policy extensions is (or should be) the subject of another "bug" (an enhancement request).
Status: UNCONFIRMED → RESOLVED
Closed: 21 years ago
Resolution: --- → INVALID
Well the original bug is solved, i agree... Still the problem remains about verifiying / importing certificates with extensions - a self signed cert w/o extensions can be successfully imported, however with extensions you will get the error that it is already installed. I think this is not a feature request but a bug itself.. Thanks for your time
Product: PSM → Core
Product: Core → MailNews Core
QA Contact: bmartin → s.mime
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: