Windows Update updates indicating they are unsigned
From: Russ (Russ.Cooper@RC.ON.CA)Date: 03/22/02
- Previous message: Luke Kenneth Casson Leighton: "Re: Potential vulnerabilities of the Microsoft RVP-based Instant Messaging"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 22 Mar 2002 07:36:52 -0500 From: Russ <Russ.Cooper@RC.ON.CA> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
I had someone contact me yesterday regarding a Security Update from WU
causing a dialog box to pop-up part way through the installation
indicating;
"The software you are about to install does not contain a Microsoft
digital signature. Therefore, there is no guarantee that this software
works correctly with Windows."
Followed by;
"Unknown software package"
It then allows you to choose "Yes" or "No" to continue with the
installation.
So I checked with Microsoft and got the following response;
--- Hello Russ:I've had the WindowsUpdate team make a full, manual check of all of the packages that are offered on the site to verify their integrity and signatures. The packages are correctly signed. We've fully verified this.
What's happening here is a known issue with a particular W2K security settings and the contents of the signed package. All packages we deliver are signed, and we always run numerous checks to make sure this is the case. However, within that signed package, there are individual files that are not themselves signed.
In W2K there is a security setting (Administrative Tools > Local Security Policy > Local Policies > Security Options > Unsigned Non-Driver Installation Behavior). If this is set to "Warn but allow installation", this prompt will be raised because there of those unsigned, individual files within the signed package.
As long as the package is correctly signed, the package is safe to install. ---
Note that nobody is suggesting you alter the setting if you have it selected as mentioned above. This is only an FYI that should you get the above-mentioned dialog you should double-check whether that setting has been made on your system and re-check the source of the installation package.
Cheers, Russ - NTBugtraq Editor
- Previous message: Luke Kenneth Casson Leighton: "Re: Potential vulnerabilities of the Microsoft RVP-based Instant Messaging"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
