However, the APIs within CryptoAPI that construct and validate certificate chains (CertGetCertificateChain(), CertVerif圜ertificateChainPolicy(), and WinVerifyTrust()) do not check the Basic Constraints field. One of these is the Basic Constraints field, which indicates the maximum allowable length of the certificate's chain and whether the certificate is a Certificate Authority or an end-entity certificate. The IETF Profile of the X.509 certificate standard defines several optional fields that can be included in a digital certificate. On 20 November 2002, we released an updated version of the patch that not only eliminates this problem, but also eliminates a newly discovered variant of the original vulnerability.
#MICROSOFT INTERNET EXPLORER 10 FOR MAC INSTALL#
As a result, customers who installed the patch could see unexpected error messages when installing new hardware, or in some cases might be unable to install new hardware altogether. On 09 September 2002, we updated the bulletin to advise customers that a Microsoft-issued digital certificate, used to sign device drivers, did not meet the stricter validation standards established by the patch. Customers who are using Windows 2000 SP4 and then installed Internet Explorer 6.0 Service Pack 1 should apply the updated Windows 2000 SP4 security patch to help protect from this vulnerability.
#MICROSOFT INTERNET EXPLORER 10 FOR MAC UPDATE#
This regression removes the update that is discussed in this bulletin and that is provided as part of Windows 2000 SP4. This revised security patch corrects a regression that may occur during the installation of Microsoft Internet Explorer 6.0 Service Pack 1 on Windows 2000 SP4. Microsoft re-issued this security bulletin on Novemto advise on the availability of an updated Microsoft Windows 2000 Service Pack 4 (SP4) security patch.
The original version of this bulletin was released on 05 September 2002. Microsoft Windows NT 4.0, Terminal Server Edition.Identity spoofing and, in some cases, ability to gain control over a user's system.Ĭustomers should install the updated version of the patch immediately, where necessary. Published: Septem| Updated: November 11, 2003Ĭustomers using Microsoft® Windows®, Office for Mac, Internet Explorer for Mac, or Outlook Express for Mac. Security Bulletin Microsoft Security Bulletin MS02-050 - Important Certificate Validation Flaw Could Enable Identity Spoofing (Q329115)
0 kommentar(er)
