{"id":1171,"date":"2012-06-05T08:52:15","date_gmt":"2012-06-05T08:52:15","guid":{"rendered":"http:\/\/www.camcert.gov.kh\/?p=1171"},"modified":"2012-06-11T16:26:08","modified_gmt":"2012-06-11T16:26:08","slug":"camsa12-07-microsoft-microsoft-security-advisory-2718704-unauthorized-digital-certificates","status":"publish","type":"post","link":"https:\/\/www.camcert.gov.kh\/en\/camsa12-07-microsoft-microsoft-security-advisory-2718704-unauthorized-digital-certificates\/","title":{"rendered":"CamSA12-07: Microsoft Security Advisory (2718704) – Unauthorized Digital Certificates"},"content":{"rendered":"

I. Overview\u00a0<\/strong><\/p>\n

Microsoft has released a security advisory to address the revocation of a number of unauthorized digital certificates. Maintaining these certificates within your certificate store may allow an attacker to spoof content, perform a phishing attack, or perform a man-in-the-middle attack.<\/p>\n

The following certificates have been revoked by this update:<\/p>\n

–\u00a0Microsoft Enforced Licensing Intermediate PCA (2 certificates)<\/p>\n

–\u00a0Microsoft Enforced Licensing Registration Authority CA (SHA1)<\/p>\n

An attacker could obtain a certificate that could be used to illegitimately sign code as Microsoft. The signed code could then be used in a variety of attacks in which the code would appear to be trusted by Windows.<\/p>\n

An attacker could offer software that appeared to be signed by a valid and trusted Microsoft certificate chain. As noted in an\u00a0MSRC blog post<\/a>, “…some components of the [Flame] malware have been signed by certificates that allow software to appear as if it was produced by Microsoft.”<\/p>\n

II. Effected System<\/strong><\/p>\n

– Microsoft Windows XP and Server 2003
\n– Microsoft Windows Vista and Server 2008
\n– Microsoft Windows 7 and Server 2008 R2
\n– Microsoft Windows 8 Consumer Preview
\n– Microsoft Windows Mobile and Phone<\/p>\n

III. Patches<\/strong><\/p>\n

– Microsoft Knowledge Base Article 2718704<\/a><\/p>\n

IV. Solutions<\/strong><\/p>\n

It is important to act quickly to revoke trust in the affected certificates. Any certificates issued by the Microsoft Terminal Services licensing certificate authority (CA) could be used for illegitimate purposes and should not be trusted.<\/p>\n

Apply updates<\/strong><\/p>\n

Apply the appropriate versions of\u00a0KB2718704<\/a>\u00a0to add the affected certificates to the Untrusted Certificate Store. Updates will reach most users via automatic updates and Windows Server Update Services (WSUS<\/a>).<\/p>\n

Revoke trust in affected certificates<\/strong><\/p>\n

Manually add the affected certificates to the Untrusted Certificate Store. The\u00a0Certifcates MMC snap-in<\/a>\u00a0and\u00a0Certutil<\/a>\u00a0command can be used on Windows systems.<\/p>\n

V. Contact Information<\/strong><\/p>\n

– Email: office@camcert.gov.kh<\/p>\n

– Tel: (855) 92 335 536 \u2013 (855) 16 888 209<\/p>\n

[message_box title=”Disclaimer” color=”yellow”]<\/p>\n

The information provided herein is on “as is” basis, without warranty of any kind.<\/p>\n

[\/message_box]<\/p>\n

 <\/p>\n"},"excerpt":{"rendered":"

I. Overview\u00a0 Microsoft has released a security advisory to address the revocation of a number of unauthorized digital certificates. Maintaining these certificates within your certificate store may allow an attacker to spoof content, perform a phishing attack, or perform a man-in-the-middle attack. The following certificates have been revoked by this update: –\u00a0Microsoft Enforced Licensing Intermediate […]<\/p>\n","protected":false},"author":1,"featured_media":1117,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,9],"tags":[85,84],"class_list":["post-1171","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-13","category-security-alert","tag-85","tag-security-alert"],"_links":{"self":[{"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/posts\/1171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/comments?post=1171"}],"version-history":[{"count":4,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/posts\/1171\/revisions"}],"predecessor-version":[{"id":1175,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/posts\/1171\/revisions\/1175"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/media\/1117"}],"wp:attachment":[{"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/media?parent=1171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/categories?post=1171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.camcert.gov.kh\/en\/wp-json\/wp\/v2\/tags?post=1171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}