Microsoft KB Archive/293811

= Update Available to Revoke Fraudulent Microsoft Certificates Issued by VeriSign =

Article ID: 293811

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 4
 * Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 5
 * Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 6
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT 4.0 Service Pack 1
 * Microsoft Windows NT 4.0 Service Pack 2
 * Microsoft Windows NT 4.0 Service Pack 3
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT 4.0 Service Pack 5
 * Microsoft Windows NT 4.0 Service Pack 6a
 * Microsoft Windows NT Server 4.0 Enterprise Edition
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT 4.0 Service Pack 5
 * Microsoft Windows NT 4.0 Service Pack 6a
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows Millennium Edition
 * Microsoft Windows 98 Second Edition
 * Microsoft Windows 98 Standard Edition
 * Microsoft Windows 95

-



This article was previously published under Q293811



SUMMARY
In March, 2001, VeriSign, Inc. announced that it had issued two digital certificates to an individual who fraudulently claimed to be a Microsoft employee. This issue is discussed at length in Microsoft Security Bulletin MS01-017. VeriSign has revoked these certificates, and they are listed in the current VeriSign Certificate Revocation List (CRL). However, because the VeriSign code-signing certificates do not specify a CRL Distribution Point (CDP), it is not possible for any browser's CRL-checking mechanism to locate and use the VeriSign CRL. Microsoft has developed an update that rectifies this problem. The update package includes a CRL that contains the two certificates, and an installable revocation handler that consults the CRL on the local computer, rather than attempting to use the CDP mechanism.

Important Notes

 * If you upgrade or reinstall any version of Internet Explorer or Windows, you must reinstall this update. You also must reinstall this update if you install any IEAK package, including a Single disk branding.

NOTE:You do not need to reinstall this update if you upgrade to Windows XP, Windows 2000 SP2, or Internet Explorer 6.
 * If you choose to use a local copy of the VeriSign CRL manually rather than the CRL that is supplied with the update, be aware that the full VeriSign CRL is short-lived and must be refreshed weekly.
 * If you manually install the full VeriSign CRL before you install this update, you should install a new version of the CRL afterwards.

For additional information about this issue, click the article number below to view the article in the Microsoft Knowledge Base:

293818 Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard

For additional information about how to recognize these fraudulent certificates, click the article number below to view the article in the Microsoft Knowledge Base:

293817 How to Recognize Erroneously-Issued VeriSign Code-Signing Certificates

For additional information about how to revoke these certificates' trusted status, click the article number below to view the article in the Microsoft Knowledge Base:

293816 How to Determine Whether You Have Accepted Trust for Fraudulent VeriSign-Issued Certificates

For additional information about how to remove VeriSign Commercial Software Publishers CA from the trusted store, click the article number below to view the article in the Microsoft Knowledge Base:

293819 How to Remove a Root Certificate from the Trusted Root Store



MORE INFORMATION
The following file is available for download from the Microsoft Download Center:

Download Crlupd.exe now

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to Obtain Microsoft Support Files from Online Services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file. This update has been tested on the following operating systems with Internet Explorer 4.01 Service Pack 2, Internet Explorer 5.01 Service Pack 1 or Service Pack 2, and Internet Explorer 5.5 Service Pack 1:
 * Windows 95
 * Windows 98
 * Windows 98 Second Edition
 * Windows Millennium Edition (Me)
 * Windows NT 4.0 Workstation SP4, SP5, or SP6a
 * Windows NT 4.0 Server and Server, Enterprise Edition, SP4, SP5, or SP6a
 * Windows NT 4.0 Server, Terminal Server Edition, SP4, SP5, or SP6
 * Windows 2000 Professional, Server, Advanced Server, or Datacenter Server (released version or SP1)

NOTE: Although you can install this update on any version of Internet Explorer, it has been tested only in conjunction with the versions that are listed above. The update does not function if you are using a version of Internet Explorer earlier than Internet Explorer 4.0. Microsoft strongly recommends that you upgrade to Internet Explorer 5 or later before you install this update.

To obtain the latest version of Internet Explorer, visit the following Microsoft Web site:

http://www.microsoft.com/windows/ie

Additional query words: check for publisher's certificate revocation

Keywords: kbinfo kbgraphxlinkcritical kb3rdparty KB293811

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.