Home page logo
/

bugtraq logo Bugtraq mailing list archives

Java HotSpot Cryptographic Provider signature verification vulnerability
From: Zacheusz Siedlecki <Zacheusz.Siedlecki () gmail com>
Date: Mon, 6 Jun 2011 17:38:23 +0200

An attacker can add a cryptographic provider containing cipher
implementation signed by an untrusted certificate. The attacker can
also create his or her own jurisdiction policy files signed by an
untrusted certificate.
In order to achieve this, the attacker must first of all add a fake
cryptographic provider (with index 1) with special
CertificateFactory.X.509 implementation. Such provider is not required
to be signed. This implementation can return attacker's own untrusted
certificate instead of one of the old JCE code signing certificates.
This vulnerability is caused by using CertificateFactory#getInstance
without specifying "SUN" provider in the code which is responsible for
providers (and jurisdiction policy) signature verification.
This applies to all versions of Java HotSpot SE 5 and 6.
More details and code samples here:
http://java.zacheusz.eu/provider-signature-verif-vuln-2/273/
          Regards,
              Zacheusz Siedlecki


  By Date           By Thread  

Current thread:
  • Java HotSpot Cryptographic Provider signature verification vulnerability Zacheusz Siedlecki (Jun 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]