Mozilla Foundation Security Advisory 2010-70
Title: SSL wildcard certificate matching IP addresses
Announced: October 19, 2010
Reporter: Richard Moore
Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 3.6.11
Security researcher Richard Moore reported that when an SSL certificate was created with a common name containing a wildcard followed by a partial IP address a valid SSL connection could be established with a server whose IP address matched the wildcard range by browsing directly to the IP address. It is extremely unlikely that such a certificate would be issued by a Certificate Authority.