News

Patch Posted for Critical Vulnerability Involving Certificates in Windows

Microsoft alerted users early Thursday to a critical vulnerability involving an ActiveX control that ships in all supported Windows clients. A patch is available.

The ActiveX control, known as the Certificate Enrollment Control, is for allowing Web-based certificate enrollments. Specifically, the control submits PKCS #10 compliant certificate requests. When it receives the requested certificate, the control stores it in the user's local certificate store.

"An attacker who successfully exploited the vulnerability could corrupt trusted root certificates, EFS encryption certificates, e-mail signing certificates, and any other certificates on the system, thereby preventing the user from using these features," Microsoft warned.

A patch replaces the ActiveX control with one that does not contain the flaw. It also replaces the SmartCard Enrollment control, which ships with Windows 2000 and Windows XP and contains a similar vulnerability that is less serious.

There are two ways an attacker could exploit the critical flaw. The attacker could lure users to a Web page on a site that exploits the vulnerability. Or the attacker could send the page as an HTML e-mail.

Exploiting the flaw is "an extremely complex process," Microsoft asserts. The company lists several mitigating factors. Users are immune to the Web site-based attack vector if ActiveX controls are disabled in the Internet Explorer Security Zone associated with the attacker's site. Outlook 2002 and Outlook Express 6 open HTML e-mail in the Restricted Sites Zone by default. Outlook 98 and Outlook 2000 also open HTML e-mail in the Restricted Sites Zone if users have installed the Outlook E-mail Security Update.

The critical vulnerability affects Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000 and Windows XP. Microsoft categorizes the impact as a denial of service.

For more information, see Microsoft's security bulletin:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-048.asp.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • FTC Expands Microsoft Antitrust Investigation Under Trump Administration

    The Federal Trade Commission (FTC) is pressing ahead with a broad investigation into Microsoft's business practices, an inquiry that began in the final weeks of the Biden administration.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Microsoft to Shut Down Skype Services

    Microsoft will discontinue its Skype telecommunications and video calling services on May 5, 2025, marking the end of the platform's decades-long run.

  • Big Blue To Acquire Datastax in Enterprise AI Play

    In a bid to bolster its enterprise-aimed AI capabilities, IBM is planning to acquire Datastax, a leading AI and data solutions provider, for an undisclosed amount.

Most   Popular