midori: Loads HTTPS with SSL errors without any notice

Debian Bug report logs - #607497
midori: Loads HTTPS with SSL errors without any notice

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Witold Baryluk <baryluk@smp.if.uj.edu.pl>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: midori: Loads HTTPS with SSL errors without any notice

Date: Sun, 19 Dec 2010 04:05:00 +0100

Package: midori
Version: 0.2.7-1.1
Severity: grave
Tags: security squeeze
Justification: user security hole

Simple example

Go to https://turtle.libre.fm/
(this site have expired ssl certificate, and it is issued to other domain).

Address bar in midori will go red, yes, but there is no way to see what is
wrong.
(One can use wget or openssl sclient ... or other browser)

What is worse, midori actually loads this page and shows us a page.

It should block request, and should not make connection so easy.
(IMHO there should not even be a way to bypass this errors).

Possible private data leakage:
  - cookies
  - private urls
  - logins, passwords data
  - confidential informations on page.

This bug makes MITM attack quite simple.

Yes, user will notice this (becuase of red address bar), but it will be already
to late to do anything - data was already sent and received.


Thanks.



-- System Information:
Debian Release: 6.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.37-rc5-sredniczarny-11471-g6313e3c (SMP w/1 CPU core; PREEMPT)
Locale: LANG=pl_PL.utf8, LC_CTYPE=pl_PL.utf8 (charmap=UTF-8) (ignored: LC_ALL set to pl_PL.utf8)
Shell: /bin/sh linked to /bin/dash

Versions of packages midori depends on:
ii  dbus-x11                 1.2.24-3        simple interprocess messaging syst
ii  dpkg                     1.15.8.6        Debian package management system
ii  libatk1.0-0              1.30.0-1        The ATK accessibility toolkit
ii  libc6                    2.11.2-7        Embedded GNU C Library: Shared lib
ii  libcairo2                1.8.10-6        The Cairo 2D vector graphics libra
ii  libdbus-1-3              1.2.24-3        simple interprocess messaging syst
ii  libdbus-glib-1-2         0.88-2          simple interprocess messaging syst
ii  libfontconfig1           2.8.0-2.1       generic font configuration library
ii  libfreetype6             2.4.2-2.1       FreeType 2 font engine, shared lib
ii  libglib2.0-0             2.24.2-1        The GLib library of C routines
ii  libgtk2.0-0              2.20.1-2        The GTK+ graphical user interface 
ii  libjs-mootools           1.2.5~debian1-2 compact JavaScript framework
ii  libnotify1 [libnotify1-g 0.5.0-2         sends desktop notifications to a n
ii  libpango1.0-0            1.28.3-1        Layout and rendering of internatio
ii  libsoup2.4-1             2.30.2-1        an HTTP library implementation in 
ii  libsqlite3-0             3.7.4-1         SQLite 3 shared library
ii  libunique-1.0-0          1.1.6-1.1       Library for writing single instanc
ii  libwebkit-1.0-2          1.2.5-2.1       Web content engine library for Gtk
ii  libx11-6                 2:1.3.3-4       X11 client-side library
ii  libxml2                  2.7.8.dfsg-1    GNOME XML library

Versions of packages midori recommends:
ii  gnome-icon-theme              2.30.3-2   GNOME Desktop icon theme

midori suggests no packages.

-- no debconf information

Message #10 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: 607497@bugs.debian.org, 607497-submitter@bugs.debian.org, control@bugs.debian.org

Subject: Re: [Secure-testing-team] Bug#607497: midori: Loads HTTPS with SSL errors without any notice

Date: Sun, 19 Dec 2010 13:31:40 -0500

severity 607497 important
fixed 607497 0.2.7-1.1
thanks

On Sun, 19 Dec 2010 04:05:00 +0100 Witold Baryluk wrote:

> Package: midori
> Version: 0.2.7-1.1
> Severity: grave
> Tags: security squeeze
> Justification: user security hole
> 
> Simple example
> 
> Go to https://turtle.libre.fm/
> (this site have expired ssl certificate, and it is issued to other domain).
> 
> Address bar in midori will go red, yes, but there is no way to see what is
> wrong.
> (One can use wget or openssl sclient ... or other browser)
> 
> What is worse, midori actually loads this page and shows us a page.
> 
> It should block request, and should not make connection so easy.
> (IMHO there should not even be a way to bypass this errors).
> 
> Possible private data leakage:
>   - cookies
>   - private urls
>   - logins, passwords data
>   - confidential informations on page.
> 
> This bug makes MITM attack quite simple.
> 
> Yes, user will notice this (becuase of red address bar), but it will be already
> to late to do anything - data was already sent and received.

This is CVE-2010-3900 [0].  It has been decided that since Midori's
support for SSL is inherently limited that this fix won't be applied
for squeeze.  It is currently recommended to not use midori if SSL
support is important to you.  Epiphany or chromium are the preferred
webkit-based browsers.

Best wishes,
Mike

[0] http://security-tracker.debian.org/tracker/CVE-2010-3900

Message #22 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Tomas Hoger <thoger@redhat.com>

To: 607497@bugs.debian.org

Subject: Re: midori: Loads HTTPS with SSL errors without any notice

Date: Mon, 20 Dec 2010 10:02:07 +0100

Hi Mike!

What Witold reports is actually post-CVE-2010-3900 behavior.  Does any
webkitgtk-based epiphany version offer any more protection than after
connect / fetch warning?

th.

Message #31 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Francesco Poli <invernomuto@paranoici.org>

To: 607497@bugs.debian.org

Subject: Re: midori: Loads HTTPS with SSL errors without any notice

Date: Thu, 6 Oct 2011 00:28:20 +0200

[Message part 1 (text/plain, inline)]

On Sun, 19 Dec 2010 04:05:00 +0100 Witold Baryluk wrote:

[...]
> Go to https://turtle.libre.fm/
> (this site have expired ssl certificate, and it is issued to other domain).
> 
> Address bar in midori will go red, yes, but there is no way to see what is
> wrong.
[...]

I would like to add a little more information.

As noted in the upstream bug [1], Midori currently lacks a certificate
manager and an accurate certificate verification mechanism.

[1] https://bugs.launchpad.net/midori/+bug/706857

Moreover, the color of the location bar is sometimes misleading: it
happens that it becomes red ("Not verified"), and then, after clicking
on the little (i) icon, it becomes yellow ("Verified and encrypted
connection") upon reloading the page. Sometimes the opposite happens
(a page is considered verified, but turns into non-verified after
clicking on the little locker icon).

I hope that these issues may be solved very soon.
Midori is a nice lightweight web browser with a great potential, but a
modern browser cannot afford lacking proper SSL certificate management
and verification!


-- 
 http://www.inventati.org/frx/frx-gpg-key-transition-2010.txt
 New GnuPG key, see the transition document!
..................................................... Francesco Poli .
 GnuPG key fpr == CA01 1147 9CD2 EFDF FB82  3925 3E1C 27E1 1F69 BFFE

[Message part 2 (application/pgp-signature, inline)]

Message #46 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Sergio Durigan Junior <sergiodj@sergiodj.net>

To: Francesco Poli <invernomuto@paranoici.org>

Cc: 607497@bugs.debian.org

Subject: Re: Bug#607497: midori: Loads HTTPS with SSL errors without any notice

Date: Wed, 21 Oct 2015 01:31:00 -0400

[Message part 1 (text/plain, inline)]

On Wednesday, October 05 2011, Francesco Poli wrote:

> On Sun, 19 Dec 2010 04:05:00 +0100 Witold Baryluk wrote:
>
> [...]
>> Go to https://turtle.libre.fm/
>> (this site have expired ssl certificate, and it is issued to other domain).
>> 
>> Address bar in midori will go red, yes, but there is no way to see what is
>> wrong.
> [...]
>
> I would like to add a little more information.
>
> As noted in the upstream bug [1], Midori currently lacks a certificate
> manager and an accurate certificate verification mechanism.
>
> [1] https://bugs.launchpad.net/midori/+bug/706857
>
> Moreover, the color of the location bar is sometimes misleading: it
> happens that it becomes red ("Not verified"), and then, after clicking
> on the little (i) icon, it becomes yellow ("Verified and encrypted
> connection") upon reloading the page. Sometimes the opposite happens
> (a page is considered verified, but turns into non-verified after
> clicking on the little locker icon).
>
> I hope that these issues may be solved very soon.
> Midori is a nice lightweight web browser with a great potential, but a
> modern browser cannot afford lacking proper SSL certificate management
> and verification!

Hi there,

I am the new maintainer for Midori on Debian, and I am inclined to close
this bug.  As far as I understood from this (very old) discussion, what
was missing was a way to identify whether a website's SSL/TLS
certificate was valid or not, and take some action based on this.

Well, Midori has been offering a way to "trust a website" if the
certificate being used is not signed/valid, which means that the
connection to the website does not happen until the user actively
chooses to continue.  While I agree that the current solution still
needs some improvement, I do believe that, as far as security is
concerned, the behavior described in this report does not exist anymore.
Another thing worth mentioning is that the upstream bug has been closed
for a while now.

I realize it has been a long time since this bug (and this package) has
received any attention, so I will wait a few days to see if anybody has
anything else to say, and then I will close the bug if nobody complains.

Thanks,

-- 
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF  31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

[signature.asc (application/pgp-signature, inline)]

Message #51 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: 607497@bugs.debian.org

Subject: info

Date: Wed, 21 Oct 2015 16:13:09 +0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> While I agree that the current solution still needs some improvement, I do
> believe that, as far as security is concerned, the behavior described in this
> report does not exist anymore.

Then you can close this bug.

> I realize it has been a long time since this bug (and this package) has
> received any attention

Received attention should not be the indicator of whether bug should be closed
or not.

I do not know what happened to tags in this bug report, but in Debian security
tracker this issue has been marked as fixed in 0.2.7-1.1 version. There is also
a note that Midori should not be used if SSL support is important to you. Is
this correct information?

Please see: https://security-tracker.debian.org/tracker/CVE-2010-3900

I can also do some testing if that is needed. If user should not use Midori when
SSL/TLS support is important then it should be clearly pointed out at least in
the man page.

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJWJ49lAAoJECet96ROqnV0nWQQAI5Jobp+aeKcm3IWt2j4PFMU
7vuz6saI0vzpFfWFeBPW2oF622wyeUf4uwpiKGEDZzMcSSCSLp3IoGDDv9Qte4WK
rcjSVkyCJuxro+4rnFALjaqyC1IsajRsKdpHpQAEZKL2p9LLofReBnl871f0eBIo
kCy6dzmG3RhWSafQeL86x1TQ6gZLVcl3eWvNfnEql2rRq2rU85dR/VNaUnISrS9k
6HqLkW90ToTB/+huMp1ftD/SVNaucA0SkObskXskO9xlo8LAL5yJBQ8ZA98veS/p
XrOh8D7nLmxvBd79sxj4SaAhKa0+9O5CHZLzUXSTbKSGMzq5VRToXGF5nsDCMSs+
vZ8mfEJ6qsIaiJLpq+B3w2tvbYNg8veZs3VeDBQtALmGVcbwCTko6cdKlgPjxB7O
+C3vruCGgPthKWVYPKZ7Z0Ug6Nk93YKU0ZVNtu/vXI0GSmty4Z9r3nxt13r5G/0I
YDzzHYUeP4j+EDvobNCFAqjvZLQxh4wmSP8of+98KxDOd8VODA6kfXVMLkP1fXH0
XudRyvIDIjJyXUN1lYQtpuxghBXmVC581IWCwV033ki1ZUHphM+lyK4sWGELGkIy
waZ/fV8SWA3MjxaMTWWpUdfnDw8hJL+SvQd56Oa6sBy3kO+3R3XlALRpbfjA+v8Y
7zheUuiltaANV1qvmO38
=IsEI
-----END PGP SIGNATURE-----

Message #56 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Sergio Durigan Junior <sergiodj@sergiodj.net>

To: Henri Salo <henri@nerv.fi>

Cc: 607497@bugs.debian.org

Subject: Re: Bug#607497: info

Date: Wed, 21 Oct 2015 13:28:31 -0400

[Message part 1 (text/plain, inline)]

On Wednesday, October 21 2015, Henri Salo wrote:

>> While I agree that the current solution still needs some improvement, I do
>> believe that, as far as security is concerned, the behavior described in this
>> report does not exist anymore.
>
> Then you can close this bug.

This bug is important enough that it deserves a double-check, therefore
I do not think I can just close it out of nowhere.

>> I realize it has been a long time since this bug (and this package) has
>> received any attention
>
> Received attention should not be the indicator of whether bug should be closed
> or not.

I did not say this.

> I do not know what happened to tags in this bug report, but in Debian security
> tracker this issue has been marked as fixed in 0.2.7-1.1 version. There is also
> a note that Midori should not be used if SSL support is important to you. Is
> this correct information?

To the extent of my knowledge, no.

> Please see: https://security-tracker.debian.org/tracker/CVE-2010-3900

What makes you think I did not see this?

> I can also do some testing if that is needed. If user should not use Midori when
> SSL/TLS support is important then it should be clearly pointed out at least in
> the man page.

I would appreciate more testing, of course.  That is why I decided to
ping this bug instead of closing it.

-- 
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF  31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

[signature.asc (application/pgp-signature, inline)]

Message #61 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: Sergio Durigan Junior <sergiodj@sergiodj.net>

Cc: 607497@bugs.debian.org

Subject: Re: Bug#607497: info

Date: Wed, 21 Oct 2015 20:40:40 +0300

On Wed, Oct 21, 2015 at 01:28:31PM -0400, Sergio Durigan Junior wrote:
> I did not say this.

Okay. I just wanted to point it out. Not sure that how people work when they
start as a new maintainer for package with old bugs like this case.

> What makes you think I did not see this?

Not all maintainers follow/update security-tracker so I made assumption.

> I would appreciate more testing, of course.  That is why I decided to
> ping this bug instead of closing it.

Great. I can help later this week. We can also communicate in IRC if you are in
OFTC IRC-network?

-- 
Henri Salo (fgeek)

Message #66 received at 607497@bugs.debian.org (full text, mbox, reply):

From: Sergio Durigan Junior <sergiodj@sergiodj.net>

To: Henri Salo <henri@nerv.fi>

Cc: 607497@bugs.debian.org

Subject: Re: Bug#607497: info

Date: Wed, 21 Oct 2015 13:45:02 -0400

[Message part 1 (text/plain, inline)]

On Wednesday, October 21 2015, Henri Salo wrote:

>> I would appreciate more testing, of course.  That is why I decided to
>> ping this bug instead of closing it.
>
> Great. I can help later this week. We can also communicate in IRC if you are in
> OFTC IRC-network?

My nickname is sergiodj there.

Thanks,

-- 
Sergio
GPG key ID: 237A 54B1 0287 28BF 00EF  31F4 D0EB 7628 65FC 5E36
Please send encrypted e-mail if possible
http://sergiodj.net/

[signature.asc (application/pgp-signature, inline)]

Message #71 received at 607497-done@bugs.debian.org (full text, mbox, reply):

From: Adrian Bunk <bunk@debian.org>

To: 632844-done@bugs.debian.org, 586271-done@bugs.debian.org, 507399-done@bugs.debian.org, 577072-done@bugs.debian.org, 579536-done@bugs.debian.org, 580646-done@bugs.debian.org, 580956-done@bugs.debian.org, 581882-done@bugs.debian.org, 586054-done@bugs.debian.org, 588772-done@bugs.debian.org, 592412-done@bugs.debian.org, 593332-done@bugs.debian.org, 595250-done@bugs.debian.org, 597304-done@bugs.debian.org, 610593-done@bugs.debian.org, 615128-done@bugs.debian.org, 615521-done@bugs.debian.org, 616056-done@bugs.debian.org, 616192-done@bugs.debian.org, 618313-done@bugs.debian.org, 627760-done@bugs.debian.org, 631812-done@bugs.debian.org, 636092-done@bugs.debian.org, 645653-done@bugs.debian.org, 645889-done@bugs.debian.org, 646362-done@bugs.debian.org, 670581-done@bugs.debian.org, 673053-done@bugs.debian.org, 679015-done@bugs.debian.org, 697592-done@bugs.debian.org, 700916-done@bugs.debian.org, 718431-done@bugs.debian.org, 633644-done@bugs.debian.org, 725622-done@bugs.debian.org, 611398-done@bugs.debian.org, 627811-done@bugs.debian.org, 248437-done@bugs.debian.org, 273816-done@bugs.debian.org, 377494-done@bugs.debian.org, 577027-done@bugs.debian.org, 577930-done@bugs.debian.org, 579186-done@bugs.debian.org, 579295-done@bugs.debian.org, 580258-done@bugs.debian.org, 580849-done@bugs.debian.org, 581595-done@bugs.debian.org, 581786-done@bugs.debian.org, 582292-done@bugs.debian.org, 583823-done@bugs.debian.org, 584246-done@bugs.debian.org, 584539-done@bugs.debian.org, 584577-done@bugs.debian.org, 584668-done@bugs.debian.org, 585721-done@bugs.debian.org, 586049-done@bugs.debian.org, 586283-done@bugs.debian.org, 586661-done@bugs.debian.org, 590283-done@bugs.debian.org, 593379-done@bugs.debian.org, 597383-done@bugs.debian.org, 597457-done@bugs.debian.org, 598521-done@bugs.debian.org, 599205-done@bugs.debian.org, 602927-done@bugs.debian.org, 603123-done@bugs.debian.org, 604156-done@bugs.debian.org, 605010-done@bugs.debian.org, 607718-done@bugs.debian.org, 610740-done@bugs.debian.org, 611218-done@bugs.debian.org, 611244-done@bugs.debian.org, 611313-done@bugs.debian.org, 613206-done@bugs.debian.org, 613627-done@bugs.debian.org, 614767-done@bugs.debian.org, 616719-done@bugs.debian.org, 617519-done@bugs.debian.org, 621094-done@bugs.debian.org, 633095-done@bugs.debian.org, 633159-done@bugs.debian.org, 636916-done@bugs.debian.org, 638410-done@bugs.debian.org, 640844-done@bugs.debian.org, 641029-done@bugs.debian.org, 642997-done@bugs.debian.org, 645092-done@bugs.debian.org, 645093-done@bugs.debian.org, 650392-done@bugs.debian.org, 650490-done@bugs.debian.org, 651751-done@bugs.debian.org, 653242-done@bugs.debian.org, 655493-done@bugs.debian.org, 658214-done@bugs.debian.org, 665205-done@bugs.debian.org, 665481-done@bugs.debian.org, 666403-done@bugs.debian.org, 687149-done@bugs.debian.org, 699600-done@bugs.debian.org, 767203-done@bugs.debian.org, 503915-done@bugs.debian.org, 594545-done@bugs.debian.org, 599129-done@bugs.debian.org, 646534-done@bugs.debian.org, 660197-done@bugs.debian.org, 583873-done@bugs.debian.org, 585008-done@bugs.debian.org, 631186-done@bugs.debian.org, 663920-done@bugs.debian.org, 698485-done@bugs.debian.org, 674894-done@bugs.debian.org, 581982-done@bugs.debian.org, 582269-done@bugs.debian.org, 583877-done@bugs.debian.org, 598567-done@bugs.debian.org, 614863-done@bugs.debian.org, 645757-done@bugs.debian.org, 646509-done@bugs.debian.org, 646583-done@bugs.debian.org, 698964-done@bugs.debian.org, 680276-done@bugs.debian.org, 596792-done@bugs.debian.org, 561359-done@bugs.debian.org, 575412-done@bugs.debian.org, 578868-done@bugs.debian.org, 579591-done@bugs.debian.org, 585049-done@bugs.debian.org, 596879-done@bugs.debian.org, 596947-done@bugs.debian.org, 599533-done@bugs.debian.org, 605400-done@bugs.debian.org, 613926-done@bugs.debian.org, 630380-done@bugs.debian.org, 668034-done@bugs.debian.org, 675371-done@bugs.debian.org, 700578-done@bugs.debian.org, 489441-done@bugs.debian.org, 580126-done@bugs.debian.org, 587502-done@bugs.debian.org, 607497-done@bugs.debian.org, 620907-done@bugs.debian.org, 630888-done@bugs.debian.org, 648811-done@bugs.debian.org, 594885-done@bugs.debian.org, 598760-done@bugs.debian.org, 657483-done@bugs.debian.org, 680393-done@bugs.debian.org

Subject: Closing squeeze-only bugs

Date: Mon, 27 Feb 2017 21:34:36 +0200

Dear submitter,

these bug are tagged squeeze without any wheezy/jessie/stretch tag
implying that the bug is not present in more recent Debian releases.

squeeze is no longer supported.

We are sorry that we couldn't deal with your issue in squeeze.

If this bug was incorrectly tagged squeeze, please reopen the bug
and remove the squeeze tag.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Send a report that this bug log contains spam.