Microsoft has announced a revision to one of its Security Bulletins!

Question

Microsoft has released a revision for it's Security Bulletin MS02-050!

Answer

This question was answered on November 14, 2003. Much of the information contained herein may have changed since posting.

Microsoft released a revision for it's Security Bulletin MS02-050 this last Tuesday Nov. 11, 2003. This revised security patch corrects a regression that may occur during the installation of

MS Internet Explorer 6.0 Service Pack 1 on Windows 2000 SP4.

Several Microsoft products are affected by this flaw including most OS's. Customers who are using Windows 2000 SP4 and then installed Internet Explorer 6.0 Service Pack 1 should apply the updated Windows 2000 SP4 security patch to help protect from this vulnerability.

The vulnerability identified in the original version of the bulletin could enable an attacker who had a valid end-entity certificate to issue a subordinate certificate that, although bogus, would nevertheless pass validation. Because CryptoAPI is used by a wide range of applications, this could enable a variety of identity spoofing attacks. Microsoft encourages all customers to review the Security Bulletins to keep optimal security. The risk is considered ‘important' which is the second highest security breach they have.

Download locations for this patch:

The patches for all Windows systems are available via:

Windows Update

The complete technical details are posted at the Microsoft web site:

<a href="http://www.microsoft.com/technet/security/bulletin/MS02-050.asp"> http://www.microsoft.com/technet/security/bulletin/MS02-050.asp</a>

Author

Posted by Michal of Data Doctors on November 14, 2003