Microsoft Security Advisory (2641690)

ronjor · Nov 10, 2011

Published: Thursday, November 10, 2011

Version: 1.0
General Information
Executive Summary

Microsoft is aware that DigiCert Sdn. Bhd, a Malaysian subordinate certification authority (CA) under Entrust and GTE CyberTrust, has issued 22 certificates with weak 512 bit keys. These weak encryption keys, when broken, could allow an attacker to use the certificates fraudulently to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer. While this is not a vulnerability in a Microsoft product, this issue affects all supported releases of Microsoft Windows.

DigiCert Sdn. Bhd is not affiliated with the corporation DigiCert, Inc., which is a member of the Microsoft Root Certificate Program.

There is no indication that any certificates were issued fraudulently. Instead, cryptographically weak keys have allowed some of the certificates to be duplicated and used in a fraudulent manner.

Microsoft is providing an update for all supported releases of Microsoft Windows that revokes the trust in DigiCert Sdn. Bhd. The update revokes the trust of the following two intermediate CA certificates:

Digisign Server ID – (Enrich), issued by Entrust.net Certification Authority (2048 )
Digisign Server ID (Enrich), issued by GTE CyberTrust Global Root

Recommendation. Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service. Please see the Suggested Actions section of this advisory for more information.

Known Issues. None
Click to expand...

https://technet.microsoft.com/en-us/security/advisory/2641690

Hungry Man · Nov 10, 2011

Glad that MS and browsers are cracking down on cert companies not performing properly. This wasn't a hack but they weren't protecting themselves enough with that weak encryption.

Page42 · Nov 10, 2011

Thanks, Ron! Got it.

FanJ · Nov 11, 2011

Thanks Ron !
Got it yesterday.

ronjor · Nov 16, 2011

Updated: Wednesday, November 16, 2011

*Why was this advisory revised November 16, 2011**?*
Microsoft revised this advisory to announce the rerelease of the KB2641690 update for Windows XP Professional x64 Edition Service Pack 2 and all supported editions of Windows Server 2003. The rereleased update addresses an issue noted by customers using Windows Server Update Services (WSUS), where the applicability for the update was not properly detected.

Customers of Windows XP Professional x64 Edition Service Pack 2 and all supported editions of Windows Server 2003 should apply the rereleased version of the KB2641690 update to be protected against the use of fraudulent certificates as described in this advisory. Customers of Windows XP Service Pack 3 and supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are not affected by this rerelease.

The majority of customers have automatic updating enabled and will not need to take any action because the rereleased KB2641690 update will be downloaded and installed automatically.
Click to expand...

https://technet.microsoft.com/en-us/security/advisory/2641690

Log in or Sign up

Microsoft Security Advisory (2641690)

ronjor Global Moderator

Hungry Man Registered Member

Page42 Registered Member

FanJ Updates Team

ronjor Global Moderator

Log in or Sign up

Microsoft Security Advisory (2641690)

ronjor Global Moderator

Hungry Man Registered Member

Page42 Registered Member

FanJ Updates Team

ronjor Global Moderator

Useful Searches