The HTTP Alternative Services feature in Mozilla Firefox prior to 37.0.1 allows man-in-the-middle malicious users to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
canonical ubuntu linux 12.04 |
||
canonical ubuntu linux 14.04 |
||
canonical ubuntu linux 14.10 |
||
opensuse opensuse 13.2 |
||
opensuse opensuse 13.1 |
||
mozilla firefox |
Stop right there. This thing ain’t ready
Mozilla has pulled Firefox 37's opportunistic encryption feature after less than a week when it learned that tech designed to enhance security actually broke SSL certificate validation. A simple patch wouldn't do the trick, so Mozilla opted to release an update, Firefox 37.0.1, that removed opportunistic encryption. Going into reverse ferret mode and stripping out technology that evidently wasn't ready for prime time is a little embarrassing for Mozilla even though this is the responsible action...
Vulmon