Mozilla offers $10,000 for bugs in its new cert verification library
Posted on 28 April 2014.
In the wake of the recent discoveries of the Heartbleed OpenSSL bug and the SSL "gotofail" bug, Mozilla has announced a new and topical bug bounty program: it offers $10,000 to any researcher that discovers and responsibly reports critical security flaws in a new certificate verification library that will soon be implemented in the company's products.

Mozilla Foundation's bug bounty program is one of the most long-standing ones in the IT industry, and encompasses many of its products, services and web sites and applications.

This latest special Security Bug Bounty program has been instituted to make sure that many eyes pass through the new code and to enhance the possibility that critical security vulnerabilities (if there are any) are spotted and fixed in time.

"As we’ve all been painfully reminded recently (Heartbleed, #gotofail) correct code in TLS libraries is crucial in today’s Internet and we want to make sure this code is rock solid before it ships to millions of Firefox users," commented Daniel Veditz, Security Lead at Mozilla Corporation.

Researchers are expected to follow the previously-set guidelines for participating in the program, and will receive the $10,000 prize if the bug is found in or caused by code in security/pkix or security/certverifier as used in Firefox; is triggered through normal web browsing; and is adequately reported (details, testcases, certificates, perhaps even a PoC) by the end of June.

"We are primarily interested in bugs that allow the construction of certificate chains that are accepted as valid when they should be rejected, and bugs in the new code that lead to exploitable memory corruption," Veditz explained. "Compatibility issues that cause Firefox to be unable to verify otherwise valid certificates will generally not be considered a security bug, but a bug that caused Firefox to accept forged signed OCSP responses would be."

Other bugs that are found but not satisfy the criteria for this special bug bounty program will still be eligible for the long-standing one.


Most IT pros have seen potentially embarrassing information about their colleagues

More than three-quarters of IT professionals have seen and kept secret potentially embarrassing information about their colleagues, according to new research conducted by AlienVault.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Feb 10th