lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 10 Jul 2014 16:27:49 -0400
From: Jeffrey Walton <>
To: Full Disclosure List <>,
	BugTraq <>, FunSec List <>
Subject: [FD] Improperly Issued Digital Certificates Could Allow Spoofing

Microsoft is aware of improperly issued SSL certificates that could be
used in attempts to spoof content, perform phishing attacks, or
perform man-in-the-middle attacks. The SSL certificates were
improperly issued by the National Informatics Centre (NIC), which
operates subordinate CAs under root CAs operated by the Government of
India Controller of Certifying Authorities (CCA), which are CAs
present in the Trusted Root Certification Authorities Store. This
issue affects all supported releases of Microsoft Windows. Microsoft
is not currently aware of attacks related to this issue.

The subordinate CA has been misused to issue SSL certificates for
multiple sites, including Google web properties. These SSL
certificates could be used to spoof content, perform phishing attacks,
or perform man-in-the-middle attacks against web properties. The
subordinate CAs may also have been used to issue certificates for
other, currently unknown sites, which could be subject to similar

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists