Nine weeks after a hacker demonstrated how to spoof authentication certificates for virtually any website on the internet, users of Internet Explorer and many other applications remain susceptible because Microsoft hasn't patched the underlying vulnerability.
The bug, which resides in an application programming interface known as
CryptoAPI, causes IE and other applications that rely on the code to be tricked by fraudulent secure sockets layer certificates. It can be exploited to impersonate websites, virtual private networks, and email servers by adding a null character to the prefix of an address in a legitimate SSL credential.
