Re: Windows doesn't verify digital signature of CRL files

To: Thomas Walpuski <thomas-bugtraq@xxxxxxxxxxxx>
Subject: Re: Windows doesn't verify digital signature of CRL files
From: Valdis.Kletnieks@xxxxxx
Date: Tue, 10 Aug 2004 14:07:23 -0400
Cc: Faro Poplar <faropoplar@xxxxxxxxx>, bugtraq@xxxxxxxxxxxxxxxxx
In-reply-to: Your message of "Tue, 10 Aug 2004 07:32:40 -0000." <20040810073239.GB5926@xxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <20040809143138.25202.qmail@xxxxxxxxxxxxxxxxxxxxx> <20040810073239.GB5926@xxxxxxxxxxxx>

On Tue, 10 Aug 2004 07:32:40 -0000, Thomas Walpuski said:

> Sane use of CertGetCRLFromStore makes sure only ....

Yes.. and sane checking of subscripts prevents buffer overflows.

What's wrong with this picture? :)

Attachment: pgpHjJv0owatJ.pgp
Description: PGP signature

References:
- Windows doesn't verify digital signature of CRL files
  - From: Faro Poplar
- Re: Windows doesn't verify digital signature of CRL files
  - From: Thomas Walpuski

Prev by Date: Corsaire Security Advisory - Port80 Software ServerMask inconsistencies
Next by Date: Re: Windows doesn't verify digital signature of CRL files
Previous by thread: Re: Windows doesn't verify digital signature of CRL files
Next by thread: Windows doesn't verify digital signature of CRL files
Index(es):
- Date
- Thread