[Full-disclosure] [Full Disclosure] Unauthorized Digital Certificates Could Allow Spoofing
imipak at gmail.com
Mon Jun 4 15:06:41 BST 2012
> what does this mean?
> m$ inadvertently gave signing rights to lusers, they got rooted or
"[..] certificates issued by our Terminal Services licensing certification
authority, which are intended to only be used for license server
verification, could also be used to sign code as Microsoft. Specifically,
when an enterprise customer requests a Terminal Services activation
license, the certificate issued by Microsoft in response to the request
allows code signing without accessing Microsoft’s internal PKI
wake up the past
and tell it to stay away
-------------- next part --------------
An HTML attachment was scrubbed...
Full-Disclosure is hosted and sponsored by Secunia.