Информационная безопасность
[RU] switch to English

Дополнительная информация

  Многочисленные уязвимости безопасности в Mozilla Firefox / Seamonkey

  US-CERT Technical Cyber Security Alert TA08-087A -- Mozilla Updates for Multiple Vulnerabilities

  Mozilla Foundation Security Advisory 2008-19

  Mozilla Foundation Security Advisory 2008-18

  Mozilla Foundation Security Advisory 2008-16

Date:26 марта 2008 г.
Subject:Mozilla Foundation Security Advisory 2008-17

Mozilla Foundation Security Advisory 2008-17

Title: Privacy issue with SSL Client Authentication
Impact: Low
Announced: March 25, 2008
Reporter: Peter Brodersen and Alexander Klink
Products: Firefox, SeaMonkey

Fixed in: Firefox
 SeaMonkey 1.1.9

Peter Brodersen and Alexander Klink independently reported that the default setting for SSL Client Authentication, automatically selecting a client certificate on behalf of the user, creates a potential privacy issue for users by allowing tracking through client certificates. For users who already have certificates some real-world identity information such as an email address or name may be available to web sites depending on the purpose of the certificate and its issuer.

The default preference has been changed to prompt the user each time a website requests a client certificate.

Change the Certificate preference in the Options menu (Windows: Tools|Options, Mac: Firefox|Preferences, Linux: Edit|Preferences). Select the Advanced tab and Encryption sub-tab. Under the Certificates section select the option for "Ask me every time".

   * https://bugzilla.mozilla.org/show_bug.cgi?id=295922
   * CVE-2007-4879

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород