News

Microsoft Releases Fix for Flawed DDL Update

Microsoft re-released Security Advisory (2607712) yesterday to replace a previous flawed update that failed to include all blocked Web certificates from a Dutch certificate authority firm.

"Before September 19, 2011, the versions of update 2616676 for Windows XP and for Windows Server 2003 contained only the latest six digital certificates cross-signed by GTE and Entrust," Microsoft wrote in the Security Advisory. "These versions of the update did not contain the digital certificates that were included in update 2607712 or 2524375."

The recent update, which fixes the Security Advisory that was previously issued last Tuesday, revokes an additional 11 DigiNotar root certificates by placing them into Microsoft's Untrusted Certificate Store.

Microsoft, along with Google and Mozilla, had previously started denying all digital certificates from Dutch certificate authority firm DigiNotar earlier this month after the firm had admitted it didn't publicly disclose revoking some certificates. This also led to a vote of no confidence by the Dutch government.

"We recognize this issue as an industry problem, and we have been actively collaborating with certificate authorities, governments, and software vendors to help protect our mutual customers," Microsoft wrote in last week's Security Advisory. "We continue to investigate this issue, and will update this blog as new information becomes available."

The update, which should be applied for Windows XP and Windows Server 2003 users, helps to block a vulnerability that "could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer."

According to Microsoft, all releases of Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 are not affected by this issue and do not need the update.

Microsoft also advises that the update will require a restart before being applied.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Adding Google G Suite Migration in Exchange Admin Center

    Microsoft's Exchange Admin Center will be getting the ability to move Google G Suite calendar, contacts and e-mail data over to the Office 365 service "in the coming weeks."

  • Qualcomm Back in Datacenter Fray with AI Chip

    The chip maker joins a crowded field of vendors that are designing silicon for processing AI inference workloads in the datacenter.

  • Microsoft To Ship Surface Hub 2S Conference Device in June

    Microsoft on Wednesday announced a June U.S. ship date for one of its Surface Hub 2S conferencing room products, plus a couple of other product milestones.

  • Kaspersky Lab Nabs Another Windows Zero-Day

    Kaspersky Lab this week described more about a zero-day Windows vulnerability (CVE-2019-0859) that its researchers recently discovered, and how PowerShell was used by the exploit.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.