Consumers who check the company's security bulletin will find the cure here. VeriSign mistakenly issued two Class 3 certificates to an employee claiming to be a Microsoft employee in late January. The certificates could be used to sign programs, ActiveX controls, Office macros and other executable content. Microsoft said Windows 95, Windows 98, Windows Me, Windows NT 4.0 and Windows 2000 are affected by the vulnerability. A digital certificate is used to sign off, so to speak, on electronic documents, such as contracts, Web sites and code.
Certificates verifiy that an author has signed the document.
Unfortunately for Microsoft, the certificates are part of its software verification scheme. Both ActiveX controls and Word documents can be delivered via either Web pages or HTML mails. ActiveX controls can be automatically invoked via script, and Word documents can be automatically opened via script unless the user has applied the Office Document Open Confirmation Tool. Theoretically, a hacker could trigger a Trojan horse or some form of executable virus and make it look as though Microsoft was the perpetrator. VeriSign VP Mahi deSilva took some responsibility last week for the problem, saying that an employee had not followed the company's established procedures.