Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   OS (Microsoft)  >   Windows DLL (Any) Vendors:   Microsoft
Microsoft Windows Includes Compromised Dell Certificates
SecurityTracker Alert ID:  1034283
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 3 2015
Impact:   Modification of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Vista SP2, 2008 SP2, 7 SP1, 2008 R2 SP1, 8, 8.1, 2012, 2012 R2, RT, RT 8.1, 10; and prior service packs
Description:   A vulnerability was reported in Microsoft Windows. A remote user may be able to spoof code signing signatures.

The operating system includes some certificates ("DSDTestProvider" and "eDellCert") for which Dell disclosed the private keys. The vulnerability is due to the compromised certificates and not the operating system itself.

A remote user can use one of the certificates to issue certificates, impersonate domains, or sign code.

Windows Phone 8 and 8.1 and Windows 10 Mobile are also affected.

Impact:   A remote user can issue certificates, impersonate domains, or sign code.
Solution:   The vendor has revoked the affected CA certificates.

Systems running Windows 8, Windows 8.1, Windows RT, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows 10 Version 1511 and devices running Windows Phone 8, Windows Phone 8.1, and Windows 10 Mobile are automatically updated.

Other systems configured with the automatic updater of revoked certificates do not need to apply a fix.

The vendor's advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Configuration error

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC