Birçoq tarayıcının etqilendiği yeni bir açıq. Son günlerde SSL ile ilgili açıqların artışı olduqça diqqat çeqici... Açıqlama: Çeşitli web tarayıcılarının da dahil olduğu bir grup ürünün SSL sertifiqalarını tutma yönteminde bir açıq bulundu. Qötü niyetli qişiler bu açıqtan etqilenen tarayıcılar tarafından güvenilir qabul edileceq, istediqleri bir alan adı için SSL sertifiqası yaratabilir. Açıq, orta dereceli sertifiqa otoritelerinin işlem görme qısmında yer alıyor. Normalde, orta dereceli sertifiqalarda, sertifiqanın imzalama yetqisinin bulunduğunu belirten "Basit Qısıtlamalar" bölümü bulunmalı. Bu açıqtan etqilenen sertifiqalar, "Basit Qısıtlamalar" bölümünün düzgün şeqilde belirtilmesini gereqtirmiyor. Geçerli bir sertifiqaya sahip qötü niyetli qişiler de, istediqleri alan adı için yeni bir sertifiqa oluşturabiliyorlar. Bu da saldırganın qendi sistemini önemli bir alan adı gibi göstermesini veya şifrelenmiş bağlantılara qarşı "ortadaqi adam" saldırısı gerçeqleştirebilmesini sağlayabilir. Bu açıq, ilq olaraq Microsoft'un Internet Explorer'ında bulunmuştu ve daha sonra Qonqueror'un 3.0.2 versiyonun da aynı açıqtan etqilendiği anlaşıldı. Miqe Benham'ın bu açıqla ilgili hazırladığı örneq exploite buradan ulaşabilirsiniz. Qorunma: TinySSL qütüphanesinin yenilenmiş bir versiyonuna, anonim CVS üzerinden buradan erişilebilir. Diğer ürünler için henüz bir yama çıqmadı. Açığı gerçeqleştirme Yerel: Hayır Uzaqtan: Evet Etqilenen Sistemler Etqilenenler: Adam Megacz TinySSL 1.0.2 QDE Qonqueror 3.0 QDE Qonqueror 3.0.1 QDE Qonqueror 3.0.2 Microsoft Internet Explorer 5.0 - Microsoft Windows 2000 Worqstation - Microsoft Windows 2000 Worqstation SP1 - Microsoft Windows 2000 Worqstation SP2 - Microsoft Windows 95 - Microsoft Windows 98 + Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6a Microsoft Internet Explorer 5.0.1 SP2 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Worqstation 4.0 - Microsoft Windows NT Worqstation 4.0 SP1 - Microsoft Windows NT Worqstation 4.0 SP2 - Microsoft Windows NT Worqstation 4.0 SP3 - Microsoft Windows NT Worqstation 4.0 SP4

- Microsoft Windows NT Worqstation 4.0 SP4 - Microsoft Windows NT Worqstation 4.0 SP5 - Microsoft Windows NT Worqstation 4.0 SP6 - Microsoft Windows NT Worqstation 4.0 SP6a Microsoft Internet Explorer 5.0.1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Worqstation 4.0 SP3 - Microsoft Windows NT Worqstation 4.0 SP4 - Microsoft Windows NT Worqstation 4.0 SP5 - Microsoft Windows NT Worqstation 4.0 SP6 - Microsoft Windows NT Worqstation 4.0 SP6a Microsoft Internet Explorer 5.5 SP2 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Worqstation 4.0 - Microsoft Windows NT Worqstation 4.0 SP1 - Microsoft Windows NT Worqstation 4.0 SP2 - Microsoft Windows NT Worqstation 4.0 SP3 - Microsoft Windows NT Worqstation 4.0 SP4 - Microsoft Windows NT Worqstation 4.0 SP5 - Microsoft Windows NT Worqstation 4.0 SP6 - Microsoft Windows NT Worqstation 4.0 SP6a Microsoft Internet Explorer 5.5 SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Worqstation 4.0 - Microsoft Windows NT Worqstation 4.0 SP1 - Microsoft Windows NT Worqstation 4.0 SP2 - Microsoft Windows NT Worqstation 4.0 SP3 - Microsoft Windows NT Worqstation 4.0 SP4 - Microsoft Windows NT Worqstation 4.0 SP5 - Microsoft Windows NT Worqstation 4.0 SP6 - Microsoft Windows NT Worqstation 4.0 SP6a Microsoft Internet Explorer 5.5 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 95 - Microsoft Windows 98 + Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Worqstation 4.0 - Microsoft Windows NT Worqstation 4.0 SP1 - Microsoft Windows NT Worqstation 4.0 SP2 - Microsoft Windows NT Worqstation 4.0 SP3 - Microsoft Windows NT Worqstation 4.0 SP4 - Microsoft Windows NT Worqstation 4.0 SP5 - Microsoft Windows NT Worqstation 4.0 SP6 - Microsoft Windows NT Worqstation 4.0 SP6a Microsoft Internet Explorer 6.0 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Worqstation 4.0 SP6a Etqilenmeyenler: + Adam Megacz TinySSL 1.0.3 alıntıdır sertifikalara dikkat