Vista security exploit: X.509 certificates

@YaronNaveh

When we install an X.509 certificate in a windows store, it is valid only if we can build from it some valid certificates chain. For example, if its issuer's certificate is in the trusted root store.

However it seems there is a meaningful change between XP and Vista. In XP, when we install a certificate in the "trusted people" store it is not valid unless such chain exist:



In Vista, once we put the certificate in the TrustedPeople store it is automatically valid even if no chain exist:



This change makes sense: If we trust someone then we do not need to trust its issuer also. However there is a backward compatibility risk: non valid certificates on XP become implicitly valid on Vista which is a potential security hole.

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!