Re: [TLS] Connection diversion to other subdomains

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> On 10/27/2010 11:01 PM, Matt McCutchen wrote:
> > Strictly speaking, this is a vulnerability.  Usually the
> > effect is just goofy, though on one major web site which I won't name,
> > it led to XSS.
> >
> > How can I get the message out to holders of wildcard certificates that
> > they should prevent this attack?
> 
> I've always been suspicious of wildcard certs, but didn't have real 
> ammunition to argue against them. You may have identified one, but 
> people may point out that it's only an issue in combination with the 
> known problem of HTTP servers accepting invalid Host headers.

This is NOT an attack on TLS or TLS server certs.  And the assumption
that the use of TLS would prevent a behaviour that exists just the
same for this server on port 80 is naive.

Virtual hosting of Web Servers is a convenience function,
and whether and how much seperation of content actually exists
is completely at the discretion of the server.

The use of TLS provides a protected communication channel between
two endpoints.  It does not add anything to the trustworthyness
of the communication within.  Any server features visible on port 80
will likely be available in just the same fashion on port 443.


The Garbage-in, garbage-out principle is not affected by replacing
the garbage truck with an armoured car with security guards while
still delivering the very same contents of the very same garbage bins.

-Martin