lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 4 Jun 2012 15:06:41 +0100
From: imipak <imipak@...il.com>
To: guninski@...inski.com, Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: [Full Disclosure] Unauthorized Digital
	Certificates Could Allow Spoofing

> what does this mean?
>
> m$ inadvertently gave signing rights to lusers, they got rooted or
something else?
>

http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft-certification-authority-signing-certificates-added-to-the-untrusted-certificate-store.aspx

says:

 "[..] certificates issued by our Terminal Services licensing certification
authority, which are intended to only be used for license server
verification, could also be used to sign code as Microsoft. Specifically,
when an enterprise customer requests a Terminal Services activation
license, the certificate issued by Microsoft in response to the request
allows code signing without accessing Microsoft’s internal PKI
infrastructure."


-i

-- 
  wake up the past
    and tell it to stay away

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists