A flaw in Windows certificate validation, reported by the NSA, let attackers forge code signatures and HTTPS certificates.
Publicly disclosed: 14 January 2020
In the January 2020 updates Microsoft fixed a flaw in the Windows CryptoAPI (crypt32.dll), reported by the U.S. National Security Agency. Windows did not correctly validate certain elliptic-curve certificates, so an attacker could create a certificate that looked like it came from a trusted authority. Malware could appear signed by a legitimate vendor, and fake HTTPS sites could look genuine.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2020-0601 | High, CVSS 8.1 (spoofing) | Windows 10, Windows Server 2016 and 2019 | January 2020 security updates |
Code signatures and HTTPS certificates are the basis of trust on a computer. When they can be forged, users and even security tools can be fooled into trusting malicious software and websites.
Sources: Microsoft CVE-2020-0601, NVD CVE-2020-0601.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
