Windows CryptoAPI Spoofing Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601

by guidovranken • 7 years ago

32 7 7 years ago

portal.msrc.microsoft.com

Context: This is an anticipated vulnerability reported to Microsoft by the NSA, patched today as part of patch Tuesday.

K0nserv• 7 years ago

Note that this does not seem to be limited to software signing, but affects all X.509 certificates[0]. This means it can be used for example to man in the middle HTTPS connections.

0: https://mobile.twitter.com/taviso/status/1217146026923978752

CiPHPerCoder• 7 years ago

Page isn't loading, but it was archived.

https://archive.md/tykYn

Arnavion• 7 years ago

I'm surprised to not see patches for Windows 7 and 8.1 (vuln is rated "important", 7 ends extended support today, 8.1 still has 3 years to go, so both should've qualified). I guess the vulnerability is new in Windows 10?

danielki• 7 years ago

Win10 added support for Brainpool and Curve25519 ECC Curves [0], so this might be where the vulnerability lies

[0] https://docs.microsoft.com/en-us/windows-server/security/tls...

relaunched• 7 years ago

Microsoft ended support for Windows 7 today. The consensus is that older systems are vulnerable, but not supported by the patch.

https://support.microsoft.com/en-us/help/4057281/windows-7-s...

kjaftaedi• 7 years ago

Spoofed code signing certificate?

This sounds more like a key leak than a code exploit, no?

Windows CryptoAPI Spoofing Vulnerability

Related Stories