913787 - OCSP servers DNS names should only be looked up as FQDN

Status: UNCONFIRMED

(Core :: Security, defect)

Description

[bjoern]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 2013081600

Steps to reproduce:

I looked at tons of DNS lookups being done Firefox/Thunderbird.


Actual results:

 Looking at wireshark for useless DNS lookups reveals insane (and maybe dangerous) DNS lookups like "ocsp.startssl.com.my.dns.searchlist".


Expected results:

Firefox and Thunderbird should always look up the DNS names of OSCP servers as FQDN (with trailing dot). The DNS searach list should not be used as it might lead to faked servers or be used for DOS attacks in those environments for SSL sites that use OSCP. In any case it is also useless traffic that is being generated.