Microsoft Windows contains a flaw that is triggered by an error in an older cryptography algorithm that may allow an attacker to spoof a certificate signed by Microsoft, or more specifically the Terminal Server Licensing Service. This may make it easier for an attacker to compromise a users system.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

• Security Tracker: 1027114
• Microsoft Knowledge Base Article: 2718704
• Bugtraq ID: 53760
• Vendor Specific News/Changelog Entry: http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx
• Vendor Specific Advisory URL: http://blogs.technet.com/b/msrc/archive/2012/06/06/security-advisory-2718704-collision-attack-details-wu-update-rollout.aspx
  http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx
  http://technet.microsoft.com/en-us/security/advisory/2718704
• Other Advisory URL: http://www.us-cert.gov/control_systems/pdf/JSAR-12-151-01A.pdf
• News Article: http://www.wired.com/threatlevel/2013/03/flame-windows-update-copycat/

• Not Available

NVD does not currently have a CVSSv2 score assigned.