Microsoft Security Advisory (2798897)

ronjor · Jan 3, 2013

Published: Thursday, January 03, 2013

Version: 1.0
General Information
Executive Summary

Microsoft is aware of active attacks using one fraudulent digital certificate issued by TURKTRUST Inc., which is a CA present in the Trusted Root Certification Authorities Store. This fraudulent certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. This issue affects all supported releases of Microsoft Windows.

TURKTRUST Inc. incorrectly created two subsidiary CAs (*.EGO.GOV.TR and e-islem.kktcmerkezbankasi.org). The *.EGO.GOV.TR subsidiary CA was then used to issue a fraudulent digital certificate to *.google.com. This fraudulent certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against several Google web properties.

To help protect customers from the fraudulent use of this digital certificate, Microsoft is updating the Certificate Trust list (CTL) and is providing an update for all supported releases of Microsoft Windows that removes the trust of certificates that are causing this issue. For more information about these certificates, see the Frequently Asked Questions section of this advisory.

Recommendation. For systems using the automatic updater of revoked certificates (see Microsoft Knowledge Base Article 2677070 for details), including Windows 8, Windows RT, Windows Server 2012, and devices running Windows Phone 8, no action is needed as these systems will be automatically protected.

For Windows XP and Windows Server 2003 customers or customers who choose not to install the automatic updater of revoked certificates, Microsoft recommends that the 2798897 update be applied immediately using update management software, by checking for updates using the Microsoft Update service, or by downloading and applying the update manually. For more information, see the Suggested Actions section of this advisory.
Click to expand...

http://technet.microsoft.com/en-us/security/advisory/2798897

elapsed · Jan 3, 2013

Wow, here we go again.

Why can these random never before heard of companies issue certificates for big names like Google? Surely they should be restricted to a "lower tier".

siljaline · Jan 3, 2013

It was Google that issued the intermediary certificate.

elapsed said:

Wow, here we go again.

Why can these random never before heard of companies issue certificates for big names like Google? Surely they should be restricted to a "lower tier".
Click to expand...

siljaline · Jan 4, 2013

For those with: http://support.microsoft.com/kb/2677070 installed, no further action is required.

ComputerSaysNo · Jan 4, 2013

No surprise who it was.

FanJ · Jan 4, 2013

Thanks Ron!
I got it via Windows Update on XP-SP3; it was "essential".
http://support.microsoft.com/kb/2798897

Log in or Sign up

Microsoft Security Advisory (2798897)

ronjor Global Moderator

elapsed Registered Member

siljaline Registered Member

siljaline Registered Member

ComputerSaysNo Guest

FanJ Updates Team

Log in or Sign up

Microsoft Security Advisory (2798897)

ronjor Global Moderator

elapsed Registered Member

siljaline Registered Member

siljaline Registered Member

ComputerSaysNo Guest

FanJ Updates Team

Useful Searches