Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.1142
Fraudulent Digital Certificates Could Allow Spoofing
11 November 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Windows
Publisher: Microsoft
Operating System: Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows Mobile 6.x
Windows Phone 7
Windows Phone 7.5
Impact/Access: Provide Misleading Information -- Remote with User Interaction
Unauthorised Access -- Remote with User Interaction
Resolution: Patch/Upgrade
Reference: ESB-2011.1119
ESB-2011.1132
ESB-2011.1134
Original Bulletin:
http://technet.microsoft.com/en-us/security/advisory/2641690
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Advisory (2641690)
Fraudulent Digital Certificates Could Allow Spoofing
Published: Thursday, November 10, 2011
Version: 1.0
General Information
Executive Summary
Microsoft is aware that DigiCert Sdn. Bhd, a Malaysian subordinate
certification authority (CA) under Entrust and GTE CyberTrust, has issued 22
certificates with weak 512 bit keys. These weak encryption keys, when broken,
could allow an attacker to use the certificates fraudulently to spoof content,
perform phishing attacks, or perform man-in-the-middle attacks against all Web
browser users including users of Internet Explorer. While this is not a
vulnerability in a Microsoft product, this issue affects all supported releases
of Microsoft Windows.
DigiCert Sdn. Bhd is not affiliated with the corporation DigiCert, Inc., which
is a member of the Microsoft Root Certificate Program.
There is no indication that any certificates were issued fraudulently. Instead,
cryptographically weak keys have allowed some of the certificates to be
duplicated and used in a fraudulent manner.
Microsoft is providing an update for all supported releases of Microsoft
Windows that revokes the trust in DigiCert Sdn. Bhd. The update revokes the
trust of the following two intermediate CA certificates:
* Digisign Server ID (Enrich), issued by Entrust.net Certification
Authority (2048)
* Digisign Server ID (Enrich), issued by GTE CyberTrust Global Root
Recommendation. Microsoft recommends that customers apply the update
immediately using update management software, or by checking for updates
using the Microsoft Update service. Please see the Suggested Actions
section of this advisory for more information.
Affected Software
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2*
Windows Server 2008 for x64-based Systems Service Pack 2*
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems
Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for
x64-based Systems Service Pack 1*
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2
for Itanium-based Systems Service Pack 1
*Server Core installation affected. This advisory applies to supported
editions of Windows Server 2008 or Windows Server 2008 R2 as indicated,
whether or not installed using the Server Core installation option.
Affected Devices
Windows Mobile 6.x
Windows Phone 7
Windows Phone 7.5
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTryGuu4yVqjM2NGpAQKGBhAAkNyPwQnU6pq8qk0zGqkNUbQLxaIAn+16
minlbfPE32D/Qte1vDvyVqn4NAM2sI3ehP8ZuPWQCneWq8piib4pS1QMghQjyfh6
/yOyXraX1wfg8+E9/Q2Emkpd59Yps1L3vPGuMhA4uB7+8/oHJa7UCzabzmkaKLnH
eUnNUnjzW4yeego1R8ITUM7JxD8AaYsZ61RKhh+JTkERhLoziweRLlsIYeshKhpI
ZlGspDqm0kB3xrOtjl6epkJ9qwxq/q9iIep7Wbm8S9nxW1qFGcnMnS6m2f6Xj6qz
ufil5EEYRu4+5uG4cQzRoqZxPv0lSHNZkVc/EhpHlYQmcU/wWWoDMnJxJHQkWX7W
c2akc4SqJg7Wq1piO8okvAnK6vaDrqi5KJjN+f/moamV4sJrVvPjrztr0GOwWl3L
UsOXX4/XPOwQj/EPCiOdj1EE1/j4fZJxcnKrNPL3lhb0Y/ODVUHdrDh364qnleyn
lbKtwCRpEEgvG3wqkzKEfTHzX2VOQ89xFQPzLtlV7kMsU7XzdQ2TBgyRG4SFtPMr
q+P+uk7BZ3tADGDnvo1aeXt/nHBjEcAmO4Xi7Yx9D5rl5fW5adXzegxfamlx5/h4
rfZUB1jBC5j/BXC6KW0bpXo6QnFF4+n70/k2HpnwT14x0VRTaMgLoqtM+PzWdaGd
LvXpwe4EjAM=
=crDE
-----END PGP SIGNATURE-----