Feeds

MS patches bogus certificate hole on NT, XP

The rest of you, Mac users too, will have to wait

  • alert
  • submit to reddit

Boost IT visibility and business value

Microsoft has finally begun patching a severe security flaw in its implementation of digital-certificate basic-constraints checking which we've been ranting about for nearly a month. The stuff-up makes it possible for SSL and e-mail signature certs to be forged.

Currently, Win-NT and XP users have fixes available for their kit. This leaves Win-98, 98-SE, ME, and 2K users waiting for patches which will be 'issued shortly,' the company says. There will also be patches for numerous versions of Internet Explorer, MS-Office, and Outlook Express for the Mac. On Windows it's necessary only to fix CryptoAPI for each OS version, but on Macs the situation is reversed; each Microsoft application needs to be fixed separately -- so if you're using more than one, you'll need more than one patch.

Interestingly, MS rates this Trustworthy Computing stuff-up 'Critical', in contradiction to their earlier whitewash of the issue.

Even now, with the 'C' word plastered all over the MS bulletin, the company can't resist plugging in every bit of soft-pedal boilerplate from its original 'what, us worry?' PR offering. There is no mention of the fact that a valid certificate and key have already been circulated with SSLsniff, an exploit tool developed by Mike Benham, who first reported the issue.

There is also no mention of the way SSLsniff can be used to intercept a third party's SSL session where the victim and attacker are on the same LAN. Indeed, there's no mention of Benham himself, but that's probably due to Redmond's irritation with him for spilling the beans before they were ready to have them spilt. Of course there was always a simple workaround: Windows users could have used Mozilla for both e-mail and browsing, and simply not been troubled. For its part, MS seems not to have appreciated the the elegance of this solution.

The MS bulletin and links to the patches can be found here. ®

Application security programs and practises

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Captain Kirk sets phaser to SLAUGHTER after trying new Facebook app
William Shatner less-than-impressed by Zuck's celebrity-only app
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
Chrome browser has been DRAINING PC batteries for YEARS
Google is only now fixing ancient, energy-sapping bug
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.