Updated: This morning, Microsoft started pushing out a third Windows Phone update. This update addresses a non-Microsoft issue with SSL certificates, which we covered last month. The update, which also includes the February and March (“NoDo”) updates, is being pushed out to some Windows Phones.
Fix for fraudulent third-party digital certificates. This update includes a critical fix to an industry-wide issue with nine untrusted digital certificates that were issued by one root certificate authority. These third-party digital certificates are used to access popular websites and email portals. Although this is not a Microsoft security vulnerability, these untrusted certificates may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all web browser users. This update moves the affected certificates to the “Untrusted Publishers” certificate store on Windows Phone, which helps ensure that these fraudulent certificates are not inadvertently used. For more info, see Microsoft Security Advisory (2524375).
Paul Thurrott is reporting that even “Walshied” devices–those that applied “NoDo” via a workaround–are receiving the update. This is great news, as Microsoft previously warned customers that using the workaround could prevent them from receiving updates in the future.
In other update news, MobilityDigest is reporting that HTC Surround owners are finally receiving the NoDo update. Everyone is finally on the same page.
Update: Some users seem to be having difficulties with devices that were updated using the workaround. The creator, Chris Walsh, says he’ll release a “simple fix” soon.
Microsoft is also aware of a small issue with some devices. Here’s what they had to say:
We’re currently working on two issues that could temporarily prevent some of you from receiving updates.
As some of you know, we recently halted delivery of updates to Samsung Omnia 7s after learning of a technical issue that required a new update software package. The new package is nearly ready, and we’re eager to resume updates to this model. Once I have a start date, I’ll let you know.
We’ve also been looking into reports from a small number of Samsung Focus owners on AT&T who haven’t received an update notification. Here’s what we know so far:
To accommodate high demand for the Focus last year, two separate sources of flash memory components were required during manufacturing. Focus models are identical in all other ways.
Most Focus owners are receiving our updates. But some customers with handsets containing the alternative memory component aren’t. We’re now working closely with Samsung and AT&T to test and deliver an update for this group. As soon as I have more specifics, I’ll let you know.