Microsoft fixes CVE-2020-0601 flaw, the first issue ever reported by NSA
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0601 | ECC Certificate Spoofing in Microsoft Windows CryptoAPI (Crypt32.dll) CVE-2020-0601 (known as 'Curveball') is a spoofing flaw in Crypt32.dll, the Windows CryptoAPI component that validates Elliptic Curve Cryptography (ECC) certificates, which mishandles ECC certificate parameters when checking signatures. An attacker can trigger it by signing malicious content, most notably an executable, with a spoofed, attacker-controlled ECC certificate that Windows accepts as if it were issued by a trusted certificate authority; the attack vector is network-based but requires user interaction (CVSS 3.1: 8.1, AV:N/AC:L/PR:N/UI:R). Successful exploitation makes attacker-supplied malware appear to come from a legitimate, trusted software vendor, defeating code-signing trust prompts and signature-based trust decisions, with high impact on confidentiality and integrity. Affected systems are the Microsoft Windows 10 builds 1507 through 1909 and Windows Server versions 1803, 1903, 1909, 2016 and 2019 in the CISA data, with Go also listed as an affected vendor via its ECC certificate validation, effectively covering the mainstream Windows install base at the time. The flaw was discovered by the NSA and patched in the January 2020 Patch Tuesday; it is now CISA KEV-listed (added 2021-11-03, ransomware use unknown) with very high predicted exploitation risk (EPSS 89.4%, 100th percentile), and no public PoC is tracked in this data. Do: Apply Microsoft's January 2020 Patch Tuesday cumulative security updates for all affected Windows 10 and Windows Server builds, per CISA's required action (apply updates per vendor instructions). Prioritize user workstations and servers that validate signed binaries, Authenticode signatures, or TLS certificates, since exploitation hinges on a user or application trusting a spoofed ECC-signed artifact. If Go is deployed in your environment, update Go toolchains to a patched January 2020 or later release, as Go was also acknowledged as an affected vendor. | 8.1 | 89% | KEV |
| massover 1 billion Windows devices (essentially the entire Windows 10 install base on builds 1507-1909, plus Windows Server 2016/2019 deployments) |
Full article520 words · extracted from securityaffairs.com · click to collapse
Microsoft has released a security update to address “a broad cryptographic vulnerability” that is impacting its Windows operating system.
Microsoft Patch Tuesday updates for January 2020 address a total of 49 vulnerabilities in various products, including a serious flaw, tracked as CVE-2020-0601, in the core cryptographic component of Windows 10, Server 2016 and 2019 editions.
The CVE-2020-0601 vulnerability is different from any other previously addressed flaws because it was reported by the NSA and this is the first time that the US intelligence agency has reported a bug to the tech giant.
The flaw, dubbed ‘NSACrypt’ and tracked as CVE-2020-0601, resides in the Crypt32.dll module that contains various ‘Certificate and Cryptographic Messaging functions’ used by the Windows Crypto API for data encryption.
The flaw affects the way Crypt32.dll module validates Elliptic Curve Cryptography (ECC) certificates.
In a press release published by the NSA, the agency explains “the certificate validation vulnerability allows an attacker to undermine how Windows verifies cryptographic trust and can enable remote code execution.”
“A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.” reads the security advisory published by Microsoft.
“An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.”
An attacker could exploit the flaw to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.
An attacker could also trigger the issue to spoof digital signatures on software tricking the system into believing that it is a legitimate application.
Microsoft addressed the issue by ensuring that Windows CryptoAPI completely validates ECC certificates.
Microsoft did not release technical details of the vulnerability to avoid its public exploitation.
Microsoft confirmed that it is not aware of attacks in the wild exploiting the CVE-2020-0601 flaw.
“This month we addressed the vulnerability CVE-2020-0601 in the usermode cryptographic library, CRYPT32.DLL, that affects Windows 10 systems. This vulnerability is classed Important and we have not seen it used in active attacks.” reads a blog post published by Microsoft.
“This vulnerability is one example of our partnership with the security research community where a vulnerability was privately disclosed and an update released to ensure customers were not put at risk.”
The NSA has also released a security advisory that includes mitigation information.
“NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows®1 cryptographic functionality. The certificate validation vulnerability allows an attacker to undermine how Windows verifies cryptographic trust and can enable remote code execution.” reads the NSA’s advisory.
“The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available”.
Microsoft also addresses 48 other vulnerabilities, 8 of which are rated as critical and remaining are rated as important.
None of the issues addressed this month by Microsoft were being exploited in the wild.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CVE-2020-0601, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/96414/security/microsoft-cve-2020-0601-flaw-nsa.html