bugtraq - etax 2010 failure to validate remote ssl certificate properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTinDCcAJZ+AYSUSi3w0U7dfFXBUcDdQTioWe4+4R@mail.gmail.com>
Date: Wed, 8 Sep 2010 05:09:38 +1000
From: dave b <db.pub.mail@...il.com>
To: bugtraq@...urityfocus.com
Subject: etax 2010 failure to validate remote ssl certificate properly

etax 2010[0]

1.fails to properly check the remote https server has a valid
certificate for the host it claims to be from.
Test case:
edit the hosts file like this:
IP_OF_HTTPS_SERVER_HERE etaxservices10.etax.ato.gov.au

e.g. 203.0.178.114
(note: you need a certificate for _any_ domain signed by a CA
installed on the client boxen).

2. will communicate over http if told to ;)  (mod_rewrite etc.).

... etax 2010 will send the details of the tax request in a SOAP request.
Have fun ;)

[0] http://www.ato.gov.au/individuals/content.asp?doc=/content/32234.htm&page=5

--
Small things make base men proud.		-- William Shakespeare, "Henry VI"