Friday, 16 August, 2002 Microsoft: SSL flaw is in OS not IE http://www.idg.net.nz/webhome.nsf/NL/4D4B5A5443817CECCC256C1600118C4A
John Fontana, FRAMINGHAM Microsoft said yesterday that the SSL flaw recently uncovered by an independent researcher is in multiple versions of the Windows operating system and not its Internet Explorer web browser. Company officials add that the flaw also is not in Microsoft's CryptoAPI (CAPI), which would leave a number of applications and Windows services vulnerable, not just IE. Microsoft says it is working on patches for Windows 98, ME, NT4, 2000 and XP. It will not say when the patches would be available. "This SSL flaw has been described as an [Internet Explorer] problem but it is a Windows issue. It's in the crypto of the operating system so we have to patch the OS," says Scott Culp manager of the Microsoft Security Response Center. "IE is a consumer of those crypto services." He says it is an "implementation problem in the way SSL certificates are processed where information is not available in the certificate or it is available in two places and there is a conflict." Culp says the flaw does not lie within CAPI and that it lies in code that performs validation of SSL certificate chains, meaning the hierarchy of trust that cascades from certificate authorities such as VeriSign Inc. The OS must be patched because IE does not have its own cryptography code and must rely on the OS for that service, he says. Konqueror.org was able to patch its open source Konqueror web browser, which had the same SSL flaw as IE, in under 90 minutes because it uses its own built-in certification verification library.
