News

Patch Posted for Critical Vulnerability Involving Certificates in Windows

• By Scott Bekker
• 08/29/2002

The ActiveX control, known as the Certificate Enrollment Control, is for allowing Web-based certificate enrollments. Specifically, the control submits PKCS #10 compliant certificate requests. When it receives the requested certificate, the control stores it in the user's local certificate store.

"An attacker who successfully exploited the vulnerability could corrupt trusted root certificates, EFS encryption certificates, e-mail signing certificates, and any other certificates on the system, thereby preventing the user from using these features," Microsoft warned.

A patch replaces the ActiveX control with one that does not contain the flaw. It also replaces the SmartCard Enrollment control, which ships with Windows 2000 and Windows XP and contains a similar vulnerability that is less serious.

There are two ways an attacker could exploit the critical flaw. The attacker could lure users to a Web page on a site that exploits the vulnerability. Or the attacker could send the page as an HTML e-mail.

Exploiting the flaw is "an extremely complex process," Microsoft asserts. The company lists several mitigating factors. Users are immune to the Web site-based attack vector if ActiveX controls are disabled in the Internet Explorer Security Zone associated with the attacker's site. Outlook 2002 and Outlook Express 6 open HTML e-mail in the Restricted Sites Zone by default. Outlook 98 and Outlook 2000 also open HTML e-mail in the Restricted Sites Zone if users have installed the Outlook E-mail Security Update.

The critical vulnerability affects Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000 and Windows XP. Microsoft categorizes the impact as a denial of service.

For more information, see Microsoft's security bulletin:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-048.asp.