Re: KB978601 causes "invalid digital signature" error with a CABfile

On 2010-04-17 4:15 p.m., J wrote:

> The following error message was logged: "Error 1330. A file that is
> required cannot be installed because the cabinet file setup11.cab has
> an invalid digital signature. This may indicate that the cabinet file
> is corrupt. Error 24592 was returned by WinVerifyTrust."
>
> Our product comes with 11 cab files. Only the last one gives the
> error. When you right-click on the cab file and view the certificate,
> the message is "This digital signature is not valid."

I'd hazard a guess that the file will need to be resigned. Update KB978601
changes the way in which cabinet and executable files are signed; I'm not expert
in this area, but from my interpretation of it this change will invalidate
previously good signatures under certain circumstances.

You might get better advice in microsoft.public.security.crypto.

Harry.

--
Harry Johnston
http://harryjohnston.wordpress.com

We've run into this issue with KB978601 also.

The key issue here is that MS stepped up enforcement in the signatur
validation subsystem in such a way that previously valid signatures no
don't validate.

It's a simple test:
1. Uninstall KB978601
2. Validate the signature (look in file properties). It's okay.
3. Install KB978601
4. Validate the signature again. Now it's invalid. Same file. Nothin
changed except for WinTrust.dll (the core Authenticode DLL in Window
that is updated by KB978601).

For our situation, the cab files that fail post-KB978601 validation ar
all similar: they all contain only 1 zero-length file. So essentiall
these cabs are empty (just a file list with no real contents). As soo
as we put some dummy data in the cab file (20 characters in our case)
the signature validated just fine

--
sgillbe
Posted via http://www.win7heads.co