bugtraq - Java HotSpot Cryptographic Provider signature verification vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 6 Jun 2011 17:38:23 +0200
From: Zacheusz Siedlecki <Zacheusz.Siedlecki@...il.com>
To: bugtraq@...urityfocus.com
Subject: Java HotSpot Cryptographic Provider signature verification vulnerability

An attacker can add a cryptographic provider containing cipher
implementation signed by an untrusted certificate. The attacker can
also create his or her own jurisdiction policy files signed by an
untrusted certificate.
In order to achieve this, the attacker must first of all add a fake
cryptographic provider (with index 1) with special
CertificateFactory.X.509 implementation. Such provider is not required
to be signed. This implementation can return attacker's own untrusted
certificate instead of one of the old JCE code signing certificates.
This vulnerability is caused by using CertificateFactory#getInstance
without specifying "SUN" provider in the code which is responsible for
providers (and jurisdiction policy) signature verification.
This applies to all versions of Java HotSpot SE 5 and 6.
More details and code samples here:
http://java.zacheusz.eu/provider-signature-verif-vuln-2/273/
          Regards,
              Zacheusz Siedlecki