Computer Security
[EN] securityvulns.ru no-pyccku


Related information

  Multiple bugs in ActiveX components

  Microsoft MCWNDX.OCX ActiveX buffer overflow

  NBActiveX Sure ActiveX Big Vulnerability

  LEVERAGING CROSS-PROTOCOL SCRIPTING IN MSIE

  Microsoft Terminal Server Client Buffer Overrun (A082802-1)

From:MICROSOFT <secure_(at)_microsoft.com>
Date:29.08.2002
Subject:Security Bulletin MS02-048: Flaw in Certificate Enrollment Control Could Allow Deletion of Digital Certificates (Q323172)

- ----------------------------------------------------------------------
Title:      Flaw in Certificate Enrollment Control Could Allow
           Deletion of Digital Certificates (Q323172)
Date:       28 August 2002
Software:   Microsoft Windows 98
           Microsoft Windows 98 Second Edition
           Microsoft Windows Millennium
           Microsoft Windows NT 4.0
           Microsoft Windows 2000
           Microsoft Windows XP
Impact:     Denial of service
Max Risk:   Critical
Bulletin:   MS02-048

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS02-048.asp.
- ----------------------------------------------------------------------

Issue:
======
All versions of Windows ship with an ActiveX control known as the
Certificate Enrollment Control, the purpose of which is to allow
web-based certificate enrollments. The control is used to submit PKCS
#10 compliant certificate requests, and upon receiving the requested
certificate, stores it in the user's local certificate store.

The control contains a flaw that could enable a web page, through
an extremely complex process, to invoke the control in a way that
would delete certificates on a user's system. An attacker who
successfully exploited the vulnerability could corrupt trusted root
certificates, EFS encryption certificates, email signing
certificates,
and any other certificates on the system, thereby preventing the user
from using these features.

An attack could be carried out through either of two scenarios. The
attacker could create a web page the that exploits the vulnerability,
and host it on a web site in order to attack users who visited the
site. The attacker also could send the page as an HTML mail in order
to attack the recipient.

A new version of the control is available that corrects the
vulnerability, and can be installed via the patch. A patch is
available for all other Windows systems, as discussed in the Patch
Availability section below. Internet Explorer 5 or later is a
prerequisite to installing the patch. As discussed in the Caveats
section, customers who operate web sites that use the Certificate
Enrollment Control will need to make minor revisions to their web
applications in order to use the new control. Microsoft Knowledge
Base article Q323172 details how to do this.

In addition, the patch addresses a similar, but less serious
vulnerability discovered in the SmartCard Enrollment control.
This control ships with Windows 2000 and Windows XP. A new version
of this control is also provided.

Mitigating Factors:
====================
- - The web site-based attack vector could not be exploited if ActiveX
 controls were disabled in the Security Zone associated with the
 attacker's site.
- - The mail-based attack vector could not be exploited if the
 recipient's email client handles HTML mail in the Restricted Sites
 Zone. Outlook Express 6 and Outlook 2002 open mail in this zone by
 default. Outlook 98 and 2000 open HTML mail in the Restricted Sites
 Zone if the Outlook Email Security Update has been installed.
- - The vulnerability would not enable certificates on smart cards to
 be corrupted, even if the smart card were in the system at the time
 of an attack.

Risk Rating:
============
- Internet systems: Low
- Intranet systems: Low
- Client systems: Critical

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
  Security Bulletin at
  http://www.microsoft.com/technet/security/bulletin/ms02-048.asp
  for information on obtaining this patch.

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE
FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod