mailing list archives
Re: MSA-2524375 fraudulent digital certification updates on Windows Phone
From: アドリアンヘンドリック <unixfreaxjp22 () gmail com>
Date: Sat, 26 Mar 2011 04:05:08 +0900
Followingly I read article in the below url:
which quoted Microsoft statement as per below:
“Fraudulent digital certificates are not a Microsoft security vulnerability”
explained Microsoft Trustworthy Computing manager Bruce Cowper. “We have
been working to develop a mitigation update for Windows Phones,” added
Cowper. Microsoft has not provided a specific time-line for the update
saying it will provide “additional guidance as it comes available.”
Which means that,
1. the smartphone updates for fraudulent digital certification is not
included in the MSA-2524375.
2. Microsoft agreed that until the update released smartphone platform/
windows phone browser still have the fraudulent digital certificates
2011/3/25 アドリアンヘンドリック <unixfreaxjp22 () gmail com>
Please help to advise the clarification of the MSA-2524375 updates, it may
related to the zeroday.
Regarding to the fraudulent digital certification on March 23rd, 2011
Microsoft was releasing Microsoft Security Advisory 2524375 as per below
which describing "..An update is available for all supported versions of
Windows to help address this issue.."
I was reviewing the updates described my Micorosoft is the below url:
..and found that Windows Phone a.k.a Windows Mobile wasn't included into
the updates. Does it mean that Microsoft stated that smartphone browser is
not affected by the fraudulent digital certification? Please kindly explain
if I was wrong.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/