Windows Phone7 < 7.10.8107 Out-of-Date SSL Certificate Blacklist

Medium Nessus Plugin ID 62517


The Windows Phone7 has an out-of-date SSL certificate blacklist.


Microsoft is aware that DigiCert Sdn. Bhd, a Malaysian subordinate certification authority (CA) under Entrust and GTE CyberTrust, has issued 22 certificates with weak 512 bit keys. When broken, these weak encryption keys could allow an attacker to use the certificates fraudulently to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer. While this is not a vulnerability in a Microsoft product, this issue affects all supported releases of Microsoft Windows.


Apply the relevant update provided by Microsoft.

See Also

Plugin Details

Severity: Medium

ID: 62517

File Name: windows_phone7_10_8107.nbin

Version: $Revision: 1.37 $

Type: local

Published: 2012/10/12

Modified: 2018/01/29

Dependencies: 60033

Risk Information

Risk Factor: Medium


Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:windows:winphone

Required KB Items: mdm/dependency/unlocked

Patch Publication Date: 2011/11/10

Vulnerability Publication Date: 2011/11/10