Windows CryptoAPI Spoofing Vulnerability CVE-2020-0601

NSA has discovered a critical vulnerability affecting Microsoft Windows cryptographic functionality. A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. The vulnerability affects Windows 10 and Windows Server 2016/2019 as well as applications that rely on Windows for trust functionality.

Microsoft released a patch today for Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601) and urges that everyone update their systems as quickly as possible.

A successful exploit could allow the attacker to
(1) Sign a malicious executable, making it appear the file was from a trusted, legitimate source; the user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.
Or
(2) Conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

SonicWall Capture Labs Threat Research team provides protection against this vulnerability with the following signatures:
IPS 14728:Windows CryptoAPI Spoofing Vulnerability (JAN 20) 1
IPS 14729:Windows CryptoAPI Spoofing Vulnerability (JAN 20) 2
IPS 14730:Windows CryptoAPI Spoofing Vulnerability (JAN 20) 3
IPS 14731:Windows CryptoAPI Spoofing Vulnerability (JAN 20) 4

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.