InformAction Forums

Using latest version of Noscript...
What is the signifigance of this in Error Console?

addons.mozilla.org : potentially vulnerable to CVE-2009-3555
[NoScript HTTPS] AUTOMATIC SECURE on https://addons.mozilla.org: X-Mapping-kgbglcod=5DCE4DD3FC98BAC9D6709B5FB9B0CF35; domain=addons.mozilla.org; path=/; Secure

aus2.mozilla.org : potentially vulnerable to CVE-2009-3555
services.addons.mozilla.org : potentially vulnerable to CVE-2009-3555
versioncheck.addons.mozilla.org : potentially vulnerable to CVE-2009-3555
versioncheck.addons.mozilla.org : potentially vulnerable to CVE-2009-3555
sb-ssl.google.com : potentially vulnerable to CVE-2009-3555
[NoScript HTTPS] AUTOMATIC SECURE on https://sb-ssl.google.com: PREF=ID=1f9ed71077578558:TM=1269464180:LM=1269464180:S=oSiKyasD5S9XocmF; domain=.google.com; path=/; Secure

jeno

jeno wrote:addons.mozilla.org : potentially vulnerable to CVE-2009-3555

This means that you've got some other add-on (not NoScript) which is scanning any web server you connect to for possible vulnerabilities (CVE-2009-3555 was the TLS negotiation injection bug).

jeno wrote: [NoScript HTTPS] AUTOMATIC SECURE on https://addons.mozilla.org: X-Mapping-kgbglcod=5DCE4DD3FC98BAC9D6709B5FB9B0CF35; domain=addons.mozilla.org; path=/; Secure

This means that you enabled automatic secure cookie management and NoScript promoted the X-Mapping-kgbglcod cookie to HTTPS-Only.

Only Add-ons are Noscript and Element Properties 6...
IIRC, I got the first message right before I downloaded Element Properties 6???

jeno

jeno wrote:Only Add-ons are Noscript and Element Properties 6...

Are you double-sure? it would be very weird...

Yes... positive!

jeno

Thank you so much, Giorgio! Looks like some servers need fixed, huh?
So I've no problems here then?

jeno

Just a while ago I had been reading Security:Renegotiation & trying to figure out why security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref was set to 'True'. Apparently it is True on the Branch & False (as the wiki says it should be) on the Trunk. Giorgio's link my provide the reason for that?

(Enable security.ssl.treat_unsafe_negotiation_as_broken & watch all the broken padlock icons .)

therube proposed:

Enable security.ssl.treat_unsafe_negotiation_as_broken & watch all the broken padlock icons .)

Yep, that red icon is the throbber here

What would a person really need secure connections for?
money, the internets, secure mail, to list the obvious.
So far, not the bank, the isp, the mighty gmail, that I've messaged about compliance have lifted a finger to comply.

Check certificates then, they say.
Oh ha ha.
ssl is so broken.

jeno wrote:So I've no problems here then?

Apparently not.

So is this bad it seems to pop up with the add on Microsoft.net framework assistant 1.0