0

I'm aware of the impact of MS14-066 to Windows servers/workstations, and have managed the patching our of desktop networks.

However, I am concerned that our Windows CE systems may also be affected, although I can find no specific mention of this, either way, despite searching MS & Google.

Certainly in Platform Builder, "SChannel(SSL/TLS)" is a checked option in our deployed images, so there is potential for this to affect our builds, but perhaps the slimmed down API makes CE immune?

Is anyone aware of the Compact Editions of Windows being affected by MS14-066, specifically CE6?

Improve this question

1 Answer 1

Reset to default
-1

potentially, yes. However only if the device ran a vuln service which accepts SSL/TLS certificates would it be a problem, at least at this time.

Schannel ships with all versions of CE, and the Schannel bug (there's actually several MS addressed in MS16-044) dates way back. For example, the same issue exists in Windows XP, but will remain unpatched. There's reverse engineering of the patch here http://blog.beyondtrust.com/triggering-ms14-066 , if you get the Windows 2003 patch, diff it against 2003 native, and then compare with Schannel in CE you can confirm yourself.

Improve this answer
1
  • Kevin - I've edited your comment into the post. You can do this yourself, rather than add comments.
    – Rory Alsop ♦
    Commented Nov 17, 2014 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .