Re: MS-02-052

[full-disclosure () lists netsys com (full-disclosure () lists netsys com)]

(I am the original poster of this thread)
My main problem was that the only place to obtain the patch attempted to d/l and install an *unsigned* ActiveX control 
that is required to use Windows Update.  Microsoft, it seems, have quietly replaced this with a signed control 
(however, the chain of trust only goes up to Microsoft Root Authority.)

The real nut-kicker in all this is the text on the Windows Update page that tells the user to "select YES in any 
"Security Warning" dialog boxes that appear".  Since the dialog to install a control always has a title of "Security 
Warning" whether the control is signed or not, Microsoft's instructions circumvent the whole point of code signing.  

I still have no idea whether the unsigned control of 2 days ago was legitimate or a trojan (I chose not to install it), 
and presumably MS isn't going to tell us.

--
This message has been sent via an anonymous mail relay at www.no-id.com.