Patch Posted for Critical Vulnerability Involving Certificates in Windows

Microsoft alerted users early Thursday to a critical vulnerability involving an ActiveX control that ships in all supported Windows clients. A patch is available.

The ActiveX control, known as the Certificate Enrollment Control, is for allowing Web-based certificate enrollments. Specifically, the control submits PKCS #10 compliant certificate requests. When it receives the requested certificate, the control stores it in the user's local certificate store.

"An attacker who successfully exploited the vulnerability could corrupt trusted root certificates, EFS encryption certificates, e-mail signing certificates, and any other certificates on the system, thereby preventing the user from using these features," Microsoft warned.

A patch replaces the ActiveX control with one that does not contain the flaw. It also replaces the SmartCard Enrollment control, which ships with Windows 2000 and Windows XP and contains a similar vulnerability that is less serious.

There are two ways an attacker could exploit the critical flaw. The attacker could lure users to a Web page on a site that exploits the vulnerability. Or the attacker could send the page as an HTML e-mail.

Exploiting the flaw is "an extremely complex process," Microsoft asserts. The company lists several mitigating factors. Users are immune to the Web site-based attack vector if ActiveX controls are disabled in the Internet Explorer Security Zone associated with the attacker's site. Outlook 2002 and Outlook Express 6 open HTML e-mail in the Restricted Sites Zone by default. Outlook 98 and Outlook 2000 also open HTML e-mail in the Restricted Sites Zone if users have installed the Outlook E-mail Security Update.

The critical vulnerability affects Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000 and Windows XP. Microsoft categorizes the impact as a denial of service.

For more information, see Microsoft's security bulletin:

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Spaceflight Training in the Middle of a Pandemic

    Surprisingly, the worldwide COVID-19 lockdown has hardly slowed down the space training process for Brien. In fact, it has accelerated it.

  • Surface and ARM: Why Microsoft Shouldn't Follow Apple's Lead and Dump Intel

    Microsoft's current Surface flagship, the Surface Pro X, already runs on ARM. But as the ill-fated Surface RT showed, going all-in on ARM never did Microsoft many favors.

  • IT Security Isn't Supposed To Be Easy

    Joey explains why it's worth it to endure a little inconvenience for the long-term benefits of a password manager and multifactor authentication.

  • Microsoft Makes It Easier To Self-Provision PCs via Windows Autopilot When VPNs Are Used

    Microsoft announced this week that the Windows Autopilot service used with Microsoft Intune now supports enrolling devices, even in cases where virtual private networks (VPNs) might get in the way.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.