[ISN] Microsoft: SSL flaw is in OS not IE

From: InfoSec News (isnat_private)
Date: Thu Aug 15 2002 - 04:07:14 PDT

  • Next message: InfoSec News: "[ISN] Security UPDATE, August 14, 2002"

    By John Fontana
    Network World Fusion, 08/14/02 
    Microsoft said Wednesday that the SSL flaw recently uncovered by an
    independent researcher is in multiple versions of the Windows
    operating system and not its Internet Explorer Web browser.
    Company officials added that the flaw also is not in Microsoft's
    CryptoAPI (CAPI), which would leave a number of applications and
    Windows services vulnerable, not just IE.
    Microsoft said it is working on patches for Windows 98, ME, NT4, 2000
    and XP. It would not say when the patches would be available.
    "This SSL flaw has been described as an [Internet Explorer] problem
    but it is a Windows issue. It's in the crypto of the operating system
    so we have to patch the OS," said Scott Culp manager of the Microsoft
    Security Response Center. "IE is a consumer of those crypto services."
    He said it is an "implementation problem in the way SSL certificates
    are processed where information is not available in the certificate or
    it is available in two places and there is a conflict."
    Culp said the flaw does not lie within CAPI and that it lies in code
    that performs validation of SSL certificate chains, meaning the
    hierarchy of trust that cascades from certificate authorities such as
    VeriSign. The OS must be patched because IE does not have its own
    cryptography code and must rely on the OS for that service, he said.
    Konqueror.org was able to patch its open source Konqueror Web browser,
    which had the same SSL flaw as IE, in under 90 minutes because it uses
    its own built-in certification verification library.
    Microsoft officials said it makes sense for the OS to provide
    cryptographic services to any application that needs it instead of
    each application having to include it's own cryptographic technology.
    But Culp said the SSL flaw does not effect any other application
    outside IE and that it is a client side issue only.
    "That's interesting, I'll have to do some more testing," said Mike
    Benham, an independent researcher who first reported the SSL flaw.  
    "Possibly this is a second can of worms."
    Benham reported on Tuesday that Internet Explorer had a security flaw
    that undermines the security provided by Secure Socket Layer (SSL), a
    standard for securing online transactions and electronic commerce.
    The flaw opens up a vulnerability that is called a man-in-the-middle
    attack, where the attacker can hijack an SSL session and decrypt
    messages that could contain credit card numbers or social security
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Thu Aug 15 2002 - 07:30:01 PDT