# MA-409.072014: MyCERT Advisory - Microsoft Releases Security Advisory for Improperly Issued Digital Certificates

**Date:** 16 Jul 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-409.072014  
**Advisory ID:** MA-409.072014

---

**1.0 Introduction**
Microsoft has released a security advisory to address improperly issued SSL certificates that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. According to Microsoft Advisory, the SSL certificates were improperly issued by the National Informatics Centre (NIC), which operates subordinate CAs under root CAs operated by the Government of India Controller of Certifying Authorities (CCA), which are CAs present in the Trusted Root Certification Authorities Store. This issue affects all supported releases of Microsoft Windows.
**2.0 Impact**
The improperly issued subordinate CA certificate has been misused to issue SSL certificates for multiple sites, including Google web properties. These SSL certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against several Google web properties. The subordinate CA certificate may also have been used to issue certificates for other, currently unknown sites, which could be subject to similar attacks.
**3.0 List of affected google web properties**
- google.com
- mail.google.com
- gmail.com
- www.gmail.com
- m.gmail.com
- smtp.gmail.com
- pop.gmail.com
- imap.gmail.com
- googlemail.com
- www.googlemail.com
- smtp.googlemail.com
- pop.googlemail.com
- imap.googlemail.com
- gstatic.com
- ssl.gstatic.com
- www.static.com
- encrypted-tbn1.gstatic.com
- encrypted-tbn2.gstatic.com
- login.yahoo.com
- mail.yahoo.com
- mail.yahoo-inc.com
- fb.member.yahoo.com
- login.korea.yahoo.com
- api.reg.yahoo.com
- edit.yahoo.com
- watchlist.yahoo.com
- edit.india.yahoo.com
- edit.korea.yahoo.com
- edit.europe.yahoo.com
- edit.singapore.yahoo.com
- edit.tpe.yahoo.com
- legalredirect.yahoo.com
- me.yahoo.com
- open.login.yahooapis.com
- subscribe.yahoo.com
- edit.secure.yahoo.com
- edit.client.yahoo.com
- bt.edit.client.yahoo.com
- verizon.edit.client.yahoo.com
- na.edit.client.yahoo.com
- au.api.reg.yahoo.com
- au.reg.yahoo.com
- profile.yahoo.com
- static.profile.yahoo.com
- openid.yahoo.com
**4.0 Affected Product**
List of affected Microsoft product :
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems Service Pack 1
- Windows 7 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
- Windows 8 for 32-bit Systems
- Windows 8 for x64-based Systems
- Windows 8.1 for 32-bit Systems
- Windows 8.1 for x64-based Systems
- Windows RT
- Windows RT 8.1
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
- Windows Server 2008 R2 for x64-based Systems (Server Core installation)
- Windows Server 2012 (Server Core installation)
- Windows Server 2012 R2 (Server Core installation)
- Windows Phone 8
**5.0 Recommendation**
Users are recommended to perform the update immediately for supported releases of Microsoft Windows.
> **5.1 Automatic update revoke certificate**
>
> Included in supported editions of Windows 8, Windows 8.1, Windows RT, Windows RT 8.1, Windows Server 2012, and Windows Server 2012 R2, and for devices running Windows Phone 8.
>
> For systems running Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2 that are using the automatic updater of revoked certificates (see [Microsoft Knowledge Base Article 2677070](http://support.microsoft.com/kb/2677070))
>
> Customers do not need to take any action because the Certificate Trust List (CTL) will be updated automatically.
>
> **5.2 Customers who choose not to install the automatic updater of revoked certificates**
>
> For customers running Windows XP or Windows Server 2003, or for customers who choose not to install the automatic updater of revoked certificates, Microsoft recommends that the 2917500 update be applied immediately using update management software, by:
>
> - Checking for updates using the [Microsoft Update](http://go.microsoft.com/fwlink/?LinkID=40747) service, or
>
> - Downloading and applying the update manually. See [Microsoft Knowledge Base Article 2917500](http://support.microsoft.com/kb/2917500) for download links.
>
> **5.3 Additional suggested action**
>
> - MyCERT also advises users to install the latest security updates for their computers and make sure their Anti-virus software is updated with latest signature files. [Read Understanding Anti-Virus Software for more information.](http://www.us-cert.gov/ncas/tips/ST04-005)
>
> - Good passwords management. Users are advice to use strong passwords which at least contain 8 characters in length, combination upper and lowercase, numerical character and special character. To maintain secure password, users are advice do not share password with anyone for any reason, change password periodically, avoid reuse a password, use passphrase instead a password, and avoid use same password for multiple accounts.
>
> - Patch operating system and software. Users are advised to ensure that operation systems and any installed software are fully patched, and firewall software are up to date and operational
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: https://www.mycert.org.my
Twitter: http://www.twitter.com/mycert
**6.0 References**
- [US-CERT: Microsoft Releases Security Advisory for Improperly Issued Digital Certificates](https://www.us-cert.gov/ncas/current-activity/2014/07/10/Microsoft-Releases-Security-Advisory-Improperly-Issued-Digital)
- [Microsoft Security Advisory 2916652](https://technet.microsoft.com/en-us/library/security/2916652.aspx)
- [Microsoft warns of fake Google and Yahoo domains](http://www.zdnet.com/microsoft-warns-of-fake-google-and-yahoo-domains-7000031463/)
- [Security Advisory 2982792 released, Certificate Trust List update](http://blogs.technet.com/b/msrc/archive/2014/07/10/security-advisory-2982792-released-certificate-trust-list-updated.aspx)