Switchfast Blog: The Future of IT
TLS/SSL Flaw Found in Windows
Wednesday, February 10, 2010 by Matt Hymel
Both client and server beware - Microsoft's latest Security
Advisory has addressed a publicly disclosed vulnerability in the
Transport Layer Security (TLS) and Secure Sockets Layer (SSL)
protocols. Even more, Microsoft has found it affects all
supported versions of Windows.
Microsoft gives 2 factors for the vulnerability:
- Web servers running Internet Information Services (IIS) 6.0 or
later in the default configuration are not affected by this
vulnerability, as they are only affected when configured to require
mutual authentication (an uncommon configuration).
- Customers are only affected when an attacker is able to
successfully conduct a man-in-the-middle attack by exploiting
another vulnerability, such as a local subnet attack or DNS
spoofing.
After releasing 13 security bulletins which fixed 26
vulnerabilities on this month's Patch Tuesday, the company is
merely stating that it will be investigating this latest security
flaw (meaning the fix was NOT included in this month's
patches).
There are currently no attacks trying to use the vulnerability;
however, Microsoft is vigorously working to fix it while monitoring
the situation. We might see an out-of-cycle path or have to
wait until March 9th, the next Patch Tuesday
scheduled.
Hit the link for more information and the Security Advisory (977377).
Until next time -
Matt
Switchfast Technologies
Chicago IT Support &
Consulting
Rochester
IT Support & Consulting
Leave comment: