[TLS] Connection diversion to other subdomains

[Matt McCutchen <[e-mail]>]

On Tue, 2010-10-26 at 22:49 -0400, Matt McCutchen wrote:
> On Tue, 2010-10-26 at 22:16 -0400, Matt McCutchen wrote:
> > Incidentally, it looks like lists.fedoraproject.org does not check
> > either SNI or the HTTP Host header.  I made a connection and indicated
> > admin.fedoraproject.org in both places and it happily served me wrong
> > content.  I will file a ticket.
> 
> The ticket, in case anyone is curious:
> 
> https://fedorahosted.org/fedora-infrastructure/ticket/2455
> 
> Has this kind of issue been discussed before?

The question remains open.  But I will call it a connection diversion
attack.

> I wonder if many other sites are affected.

I looked through my browser history for registered domains containing a
TLS web server bearing a wildcard certificate and another subdomain on a
different IP address.  In almost all cases, the server was willing to
send me wrong content when I asked for the other subdomain via SNI and
HTTP Host.  Strictly speaking, this is a vulnerability.  Usually the
effect is just goofy, though on one major web site which I won't name,
it led to XSS.

How can I get the message out to holders of wildcard certificates that
they should prevent this attack?

-- 
Matt