-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2002.474 -- Microsoft Security Bulletin MS02-048
      Flaw in Certificate Enrollment Control Could Allow Deletion of
                      Digital Certificates (Q323172)
                              29 August 2002

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Certificate Enrollment Control
                        SmartCard Enrollment Control
Vendor:                 Microsoft
Operating System:       Windows 98
                        Windows 98SE
                        Windows Me
                        Windows NT 4.0
                        Windows 2000
                        Windows XP
Impact:                 Denial of Service
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------
Title:      Flaw in Certificate Enrollment Control Could Allow
            Deletion of Digital Certificates (Q323172)
Date:       28 August 2002
Software:   Microsoft Windows 98 
            Microsoft Windows 98 Second Edition 
            Microsoft Windows Millennium 
            Microsoft Windows NT 4.0 
            Microsoft Windows 2000 
            Microsoft Windows XP
Impact:     Denial of service
Max Risk:   Critical
Bulletin:   MS02-048

Microsoft encourages customers to review the Security Bulletin at: 
http://www.microsoft.com/technet/security/bulletin/MS02-048.asp.
- - ----------------------------------------------------------------------

Issue:
======
All versions of Windows ship with an ActiveX control known as the 
Certificate Enrollment Control, the purpose of which is to allow 
web-based certificate enrollments. The control is used to submit PKCS
#10 compliant certificate requests, and upon receiving the requested
certificate, stores it in the user's local certificate store. 

The control contains a flaw that could enable a web page, through 
an extremely complex process, to invoke the control in a way that
would delete certificates on a user's system. An attacker who 
successfully exploited the vulnerability could corrupt trusted root 
certificates, EFS encryption certificates, email signing
certificates,
and any other certificates on the system, thereby preventing the user
from using these features. 

An attack could be carried out through either of two scenarios. The
attacker could create a web page the that exploits the vulnerability,
and host it on a web site in order to attack users who visited the 
site. The attacker also could send the page as an HTML mail in order
to attack the recipient. 

A new version of the control is available that corrects the 
vulnerability, and can be installed via the patch. A patch is 
available for all other Windows systems, as discussed in the Patch 
Availability section below. Internet Explorer 5 or later is a 
prerequisite to installing the patch. As discussed in the Caveats 
section, customers who operate web sites that use the Certificate 
Enrollment Control will need to make minor revisions to their web 
applications in order to use the new control. Microsoft Knowledge 
Base article Q323172 details how to do this. 

In addition, the patch addresses a similar, but less serious 
vulnerability discovered in the SmartCard Enrollment control. 
This control ships with Windows 2000 and Windows XP. A new version 
of this control is also provided.

Mitigating Factors:
====================
- - - The web site-based attack vector could not be exploited if ActiveX
  controls were disabled in the Security Zone associated with the 
  attacker's site. 
- - - The mail-based attack vector could not be exploited if the 
  recipient's email client handles HTML mail in the Restricted Sites 
  Zone. Outlook Express 6 and Outlook 2002 open mail in this zone by 
  default. Outlook 98 and 2000 open HTML mail in the Restricted Sites
  Zone if the Outlook Email Security Update has been installed. 
- - - The vulnerability would not enable certificates on smart cards to 
  be corrupted, even if the smart card were in the system at the time
  of an attack.

Risk Rating:
============
 - Internet systems: Low
 - Intranet systems: Low
 - Client systems: Critical

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletin at
   http://www.microsoft.com/technet/security/bulletin/ms02-048.asp
   for information on obtaining this patch.

- - ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS 
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE
FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, 
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF 
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES 
SO THE FOREGOING LIMITATION MAY NOT APPLY.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPW1Nno0ZSRQxA/UrAQHu5gf/XxYk5KdJHIBBUl2NzgAMbLM0t4YyCnja
cyJ7h0V9i39P0dpll9sLjLac5fEVVgY5rOLVU2BJUcI6houV/pE+874su0git9em
5TIM2o8M0qpwEwiQAbFnhYr89a1nACGLCaQPc/TFQvtQLLgZ48YlX63MIevqCfJk
sTve2/UJYeKZ2QpbSFaCGdMhtl9sv4D2n471zLJoBlZiCXMALyDNMJ7rDjRXOcjJ
NDopXs8hTnccnwbH6M4pFay3fYokMh5p4sfT9/9cZ3/0COmhJcBge/V57w1THZiK
NXH1NFNqBY9eb9kIY4K3Z9f1ko4lGkb6W2yDWyVk+aBkWkmPQTgwnw==
=IAg+
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPW49OCh9+71yA2DNAQFsJwP+KrVVIM1oogruGNeJoHzN/eT4+Js89v9S
YE7BvNROBitm+y57vhc9o/j1pIGaA6no1zH1C9BRTuomHQ7Kbdb1DFZR2LWat5ku
/OpIwe5kShVwcRBc/svaGelDiE+DKvnX1jCbZ1ExIGwJcNapfqN9x1kc/a+/xkir
m3wMhSBFyZM=
=UXGG
-----END PGP SIGNATURE-----