• info
• discussion
• exploit
• solution
• references

Microsoft WinHTTP Server Name Mismatch Certificate Validation Security Bypass Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=05e33cc5-cff6 -4c71-be71-285f66a95e01

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=05e33cc5-cff6 -4c71-be71-285f66a95e01

Microsoft Windows Vista x64 Edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7ceef2d0-f316 -48d1-aecc-d74f91cc5e1f

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows XP Media Center Edition SP3

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows Vista Home Premium

• Microsoft Security Update for Windows Vista (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=f071d770-3b6b -4040-9911-d4de8cde4c68

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows Server 2003 x64 SP1

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows Vista Enterprise

• Microsoft Security Update for Windows Vista (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=f071d770-3b6b -4040-9911-d4de8cde4c68

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=49b16f0f-f6c3 -4ca8-8041-392f4f7b5bbb

Microsoft Windows Vista 0

• Microsoft Security Update for Windows Vista (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=f071d770-3b6b -4040-9911-d4de8cde4c68

Microsoft Windows Vista Business

• Microsoft Security Update for Windows Vista (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=f071d770-3b6b -4040-9911-d4de8cde4c68

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows XP Tablet PC Edition SP3

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows Vista Home Basic

• Microsoft Security Update for Windows Vista (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=f071d770-3b6b -4040-9911-d4de8cde4c68

Microsoft Windows Vista Ultimate

• Microsoft Security Update for Windows Vista (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=f071d770-3b6b -4040-9911-d4de8cde4c68

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows Server 2003 SP1

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=05e33cc5-cff6 -4c71-be71-285f66a95e01

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for Windows XP x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=49b16f0f-f6c3 -4ca8-8041-392f4f7b5bbb

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=42509f5a-d0f9 -444a-9445-5eabdb555011

Microsoft Windows XP Home SP3

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=35af4151-1858 -4c9a-85e4-9ff45feca1a4

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=05e33cc5-cff6 -4c71-be71-285f66a95e01

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=7373ea32-bc2e -49f1-8b9f-4eeda5acc74c

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB960803)
  http://www.microsoft.com/downloads/details.aspx?familyid=39d5468e-5733 -4c3e-9e75-3adac8ac8cb9