Mozilla

Mozilla

Mozilla Foundation Security Advisory 2012-54

Clickjacking of certificate warning page

Announced
July 17, 2012
Reporter
Matt McCutchen
Impact
Moderate
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
Fixed in
  • Firefox 13
  • Firefox ESR 10.0.6
  • SeaMonkey 2.10
  • Thunderbird 13
  • Thunderbird ESR 10.0.6

Description

Security Researcher Matt McCutchen reported that a clickjacking attack using the certificate warning page. A man-in-the-middle (MITM) attacker can use an iframe to display its own certificate error warning page (about:certerror) with the "Add Exception" button of a real warning page from a malicious site. This can mislead users to adding a certificate exception for a different site than the perceived one. This can lead to compromised communications with the user perceived site through the MITM attack once the certificate exception has been added.

References