Problems with a security update issued this week by Microsoft have surfaced on a number of technology forums.
Windows users say Microsoft Security Advisory 303929, which adds SHA-2 code-signing and verification support for Windows 7 client machines and Windows Server 2008 R2 boxes, is causing computers to enter into an infinite loop.
A request for comment from Microsoft was not returned in time for publication. It is not clear whether or when Microsoft will pull the update back for repairs as it has with other faulty patches.
“After installation the PC reboots, but during the boot up configuration of the patch it fails and Windows starts, reverting the configuration and reboots,” said one poster on a Microsoft-sponsored Windows forum. “And then it starts all over again a couple of times until it eventually boot into Windows.”
Nine others on that one forum posted a reply noting the same problem almost verbatim.
Tuesday’s update notes that it supersedes another similar update from October and addressed issues that customers had with that installation, Microsoft said. Windows 8, 8.1, RT, RT 8.1, Windows Server 2012 and Windows Server 2012 R2 already have SHA-2 support built in. Windows Server 2003, Vista and Windows Server 2008 will not receive similar support, Microsoft said.
The SHA-1 algorithm has long been considered weak, obsolete and dangerous to deploy with collision attacks against it considered practical by 2018. Microsoft, itself, formally recommended that developers stop using SHA-1 two years ago, and deprecate other weak crypto such as RC4. By January, Microsoft developers will no longer be allowed to use SHA-1 in code signing or developer certs.
Browser makers such as Mozilla and Google have also shunned the use of SHA-1. Mozilla, last September, formally asked Certificate Authorities and websites to upgrade certificates to SHA-256, SHA-384 or SHA-512, all exponentially stronger mathematically than SHA-1, and announced that SHA-1 should not be trusted after Jan. 1, 2017.
Google, meanwhile, phased out SHA-1 usage in its Chrome browser starting last November with Chrome 40. Since then, Chrome no longer fully trusts sites whose certificate chains trust SHA-1 and extend beyond Jan. 1, 2017. Sites with SHA-1 certificates extending beyond that date will be trusted, but Chrome will note that they have “minor errors.” Staring with Chrome 40, sites with certificate chains including SHA-1 which extend beyond Jan. 1, 2017 will be marked with a blank white sheet, the current visual display for “neutral, lacking security.” Chrome 41 will treat such sites as “affirmatively insecure,” a state indicated by a padlock with a red X on top of it and a red strike through the text that says HTTPS.
