Apple blocks compromised certificates, but macOS utility may remain exposed
A Mozilla engineer says a built-in Mac utility may still accept the certificates because it does not check whether they have been revoked.
Eight compromised certificates capable of enabling website impersonation have been blocked by Apple, Google and Mozilla in their browsers, Bleeping Computer reported. But Mozilla cryptography engineer Dennis Jackson warned that a utility included with macOS may still accept them.
The certificates were vulnerable because of a mistake in the script responsible for generating them. Testing only 256 possible numbers could reveal some private keys. The affected intermediate certificates serve to verify website ownership, allowing browsers to establish whether a site is genuine.
Jackson identified /usr/bin/curl as a remaining concern on Macs. He said the utility uses a certificate bundle that does not consult revocation information, potentially allowing previously accepted certificates to remain trusted after their withdrawal.
All eight affected certificates have been revoked. Steps have also been taken to prevent the same vulnerability in certificates generated later. There is no evidence so far that anyone has exploited the compromised certificates in the wild.
