Re: MS-02-052

[SMoyer () rgare com (Moyer, Shawn)]

Hehe, how dare you try to bring a thread back on-topic! I agree on this,
I've seen the same message about saying "yes" to and security boxes come up
a number of times via WU. Don't know why MS went to all the trouble of
building the code-signing components and then doesn't bother to use their
own code. Ever notice that "check server cert revocation" is off by default,
too? Yay.

It is quite lame to make this only available via Windows Update. A lot of
people are deploying their own internal patch management methods and
blocking Windows Update / disabling the new AutoUpdate stuff so that patches
can be tested and verified first rather than letting the end-user make the
call. Not making the patches available any other way makes that kinda tough
to do. Hopefully we'll see the same patch in another form later on.




--shawn

> -----Original Message-----
> From: dev-null () no-id com [mailto:dev-null () no-id com]
> Sent: Friday, 20 September, 2002 15:22 PM
> To: full-disclosure () lists netsys com
> Subject: Re: [Full-disclosure] Re: MS-02-052
>
>
> (I am the original poster of this thread)
> My main problem was that the only place to obtain the patch 
> attempted to d/l and install an *unsigned* ActiveX control 
> that is required to use Windows Update.  Microsoft, it seems, 
> have quietly replaced this with a signed control (however, 
> the chain of trust only goes up to Microsoft Root Authority.)
>
> The real nut-kicker in all this is the text on the Windows 
> Update page that tells the user to "select YES in any 
> "Security Warning" dialog boxes that appear".  Since the 
> dialog to install a control always has a title of "Security 
> Warning" whether the control is signed or not, Microsoft's 
> instructions circumvent the whole point of code signing.  
>
> I still have no idea whether the unsigned control of 2 days 
> ago was legitimate or a trojan (I chose not to install it), 
> and presumably MS isn't going to tell us.
>
> --
> This message has been sent via an anonymous mail relay at 
> www.no-id.com.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html