Microsoft Security Advisory 2982792

ronjor · Jul 10, 2014

Published: July 10, 2014
Version: 1.0

Microsoft is aware of improperly issued SSL certificates that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. The SSL certificates were improperly issued by the National Informatics Centre (NIC), which operates subordinate CAs under root CAs operated by the Government of India Controller of Certifying Authorities (CCA), which are CAs present in the Trusted Root Certification Authorities Store. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.

The subordinate CA has been misused to issue SSL certificates for multiple sites, including Google web properties. These SSL certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against web properties. The subordinate CAs may also have been used to issue certificates for other, currently unknown sites, which could be subject to similar attacks.

To help protect customers from potentially fraudulent use of this digital certificate, Microsoft is updating the Certificate Trust list (CTL) for all supported releases of Microsoft Windows to remove the trust of certificates that are causing this issue. For more information about these certificates, see the Frequently Asked Questions section of this advisory.
Click to expand...

https://technet.microsoft.com/en-us/library/security/2982792

ronjor · Jul 11, 2014

Security Advisory 2982792 released, Certificate Trust List updated

Dustin C. Childs Dustin C. Childs
10 Jul 2014 10:00 AM

Today, we are updating the Certificate Trust List (CTL) for all supported releases of Microsoft Windows to remove the trust of mis-issued third-party digital certificates. These certificates could be used to spoof content and perform phishing or man-in-the-middle attacks against web properties.
Click to expand...

http://blogs.technet.com/b/msrc/arc...-released-certificate-trust-list-updated.aspx

Minimalist · Jul 11, 2014

Microsoft has issued an emergency update for most supported versions of Windows to prevent attacks that abuse recently issued digital certificates impersonating Google and Yahoo. Company officials warned undiscovered fraudulent credentials for other domains may still be in the wild.
Click to expand...

http://arstechnica.com/security/201...ozens-of-bogus-google-yahoo-ssl-certificates/

ronjor · Jul 17, 2014

Title: Microsoft Security Advisory Notification
Issued: July 17, 2014
Security Advisories Updated or Released Today

* Microsoft Security Advisory (2982792)
- Title: Improperly Issued Digital Certificates Could Allow
Spoofing
- https://technet.microsoft.com/library/security/2982792
- Revision Note: V2.0 (July 17, 2014): Advisory revised to
announce the availability of update 2982792 for supported
editions of Windows Server 2003. For more information, see the
Suggested Actions section of this advisory.
Click to expand...

https://technet.microsoft.com/library/security/2982792

Log in or Sign up

Microsoft Security Advisory 2982792

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

Log in or Sign up

Microsoft Security Advisory 2982792

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

Useful Searches