Clarification requested regarding remediation of StartCom certificate issuance vulnerability

This case involves StartCom's disclosure of a vulnerability in its certificate issuance system that allowed users to request certificates for any domain. The issue was identified internally, prompting StartCom to seek clarification on the remediation steps taken. StartCom confirmed that an audit was conducted, and no invalid certificates were found during subsequent checks. The case was resolved with StartCom's actions deemed satisfactory, and it continues to undergo annual audits.

1. 2009-06-18 StartCom disclosed a vulnerability in its certificate issuance system.

1. 2009-06-18 Samj representative — Requested clarification on how the vulnerability was remediated and if all issued certificates were valid.
2. 2009-06-18 Startcom representative — Explained that the issue was due to a bug in user input checking and that a report was published after detection.
3. 2009-06-18 Startcom representative — Confirmed that StartCom was under audit during the incident and that no failed validations were found.
4. 2009-06-19 Startcom representative — Stated that the procedures for incident handling were followed correctly and that the audit confirmed compliance.