Binary package hint: firefox-3.5
I have noticed that there is an SSL CA certificate for "MD5 Collisions Inc. (http://www.phreedom.org/md5)" installed as standard in Firefox 3.5. Visiting the URL in the name tells us that the certificate was created as a proof-of-concept for an attack on SSL using MD5 hash collisions, so I was somewhat surprised to see it included as a trusted CA certificate.
OK, so the validity dates in the certificate (31 July 2004 - 2 Sept 2004) and the fact that it was created as a proof-of-concept mean that it is implausible that it could be used (and so I'm not marking this as a security vulnerability,) but it's inclusion seems rather odd.
ProblemType: Bug
Architecture: i386
Date: Sat Nov 14 18:08:05 2009
DistroRelease: Ubuntu 9.10
Package: firefox-3.5 3.5.5+nobinonly-0ubuntu0.9.10.1
ProcEnviron:
LANGUAGE=en_GB.UTF-8
PATH=(custom, no user)
LANG=en_GB.UTF-8
SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic
SourcePackage: firefox-3.5
Uname: Linux 2.6.31-14-generic i686
Andrew, myself and others have looked for this certificate in various versions of firefox and cannot find it. Is it possible that it may be leftover from a much older version of firefox or that you have forgotten that you accepted this certificate at some point?