News19,135 Articles

August 15, 2002

Security flaw is in Windows, not IE

Microsoft working on patch to fix OS

John Fontana

Microsoft has revealed that the SSL (Secure Sockets Layer) security flaw uncovered by researcher, Mike Benham, is not a problem within IE (Internet Explorer), but resides in multiple versions of the Windows operating system.

Microsoft said it is working on patches for Windows 98, Me, NT 4.0, 2000 and XP. It would not say when the patches would be available.

"This SSL flaw has been described as an [Internet Explorer] problem but it is a Windows issue…so we have to patch the OS," said Scott Culp manager of the Microsoft Security Response Centre.

He said it is an "implementation problem in the way SSL certificates are processed where information is not available in the certificate or it is available in two places and there is a conflict".

Culp said the flaw lies in code that performs validation of SSL certificate chains, meaning the hierarchy of trust that cascades from certificate authorities such as VeriSign. The OS must be patched because IE does not have its own cryptography code and must rely on the OS for that service, he said.

Microsoft officials said it makes sense for the OS to provide cryptographic services to any application that needs it instead of each application having to include its own cryptographic technology.

But Culp said the SSL flaw does not effect any other application outside IE and that it is a client side issue only.

"That's interesting, I'll have to do some more testing," said Mike Benham, an independent researcher who first reported the SSL flaw. "Possibly this is a second can of worms."

<<newer story | back to index | older story>>

What is this?

Subscribe to PC Advisor now and claim your FREE gift

Keep up to date by adding PC Advisor News to your iGoogle home page or Google Reader


Question of the day!

Does your smartphone replace your need for a laptop when on the move?

Question of the day!

Does your smartphone replace your need for a laptop when on the move?

% of PC Advisor readers agree with you

Yes
TBC
No
TBC

Which parts of the desktop PC/laptop experience can't you get on your smartphone?

119 characters remaining

Follow the conversation at @SmartphoneFocus

web browsing, search facilities, voip, email, word processing everything RT @Graham_D_C

Mainly email but getting better at spreadsheets etc, RT @IDGdan
Google


Recent reviews

Reviews index


Latest reader comments

Latest reader comments


Top news

News index


Latest blog entries

Blogs index


 Our RSS feeds

Sponsored Content

  • Take the internet to new places with the Nokia N800
    Communicate how you want to, where you want to with instant messaging, email and internet calling. View movies, browse the internet wirelessly and watch TV on the high-resolution screen and listen through high-quality stereo speakers with headphone jack.
    Buy now