Security flaw is in Windows, not IE

Discussion in 'other security issues & news' started by spy1, Aug 15, 2002.

Thread Status:
Not open for further replies.
  1. spy1

    spy1 Registered Member

    Dec 29, 2002
    Clover, SC
    "by John Fontana

    Microsoft working on patch to fix OS
    Thursday, 15 August 2002

    Microsoft has revealed that the SSL (Secure Sockets Layer)

    security flaw uncovered by researcher, Mike Benham, is not a problem within IE (Internet Explorer), but resides in multiple versions of the Windows operating system.

    Microsoft said it is working on patches for Windows 98, Me, NT 4.0, 2000 and XP. It would not say when the patches would be available.

    "This SSL flaw has been described as an [Internet Explorer] problem but it is a Windows issue…so we have to patch the OS," said Scott Culp manager of the Microsoft Security Response Centre.

    He said it is an "implementation problem in the way SSL certificates are processed where information is not available in the certificate or it is available in two places and there is a conflict".

    Culp said the flaw lies in code that performs validation of SSL certificate chains, meaning the hierarchy of trust that cascades from certificate authorities such as VeriSign. The OS must be patched because IE does not have its own cryptography code and must rely on the OS for that service, he said.

    Microsoft officials said it makes sense for the OS to provide cryptographic services to any application that needs it instead of each application having to include its own cryptographic technology.

    But Culp said the SSL flaw does not effect any other application outside IE and that it is a client side issue only.

    "That's interesting, I'll have to do some more testing," said Mike Benham, an independent researcher who first reported the SSL flaw. "Possibly this is a second can of worms."
  2. Checkout

    Checkout Security Rhinoceros

    Feb 11, 2002
    Worms are nice. Worms are tasty. Open another can today.

    In MS we trust - not.
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.