A Vulnerability in the Microsoft Cryptographic Library CRYPT32.DLL Could Allow for Remote Code Execution

 

 

A Vulnerability in the Microsoft Cryptographic Library CRYPT32.DLL Could Allow for Remote Code Execution

 

 

MS-ISAC ADVISORY NUMBER:

2020-005

 

 

DATE(S) ISSUED:

01/14/2020

 

 

OVERVIEW:

 

A vulnerability has been discovered in the Microsoft Cryptographic library CRYPT32.DLL, which could allow for remote code execution. The Microsoft Cryptographic library CRYPT32.DLL is the module that implements many of the certificate and cryptographic messaging functions in the CryptoAPI. This library comes with the Windows and Windows Server Operating Systems. Successful exploitation of this vulnerability could allow for attackers to compromise trusted network connections using spoofed certificates. This can be used to deliver malicious executable code under the pretense of a legitimately trusted entity, commit man-in-the-middle attacks, and decrypt confidential information. Examples of potentially impacted services include HTTPS connections, signed emails and files, and user-mode processes launching signed executable code.

 

 

THREAT INTELLIGENCE:

 

 

There is currently no report of this vulnerability being exploited in the wild. CISA anticipates that attempted exploits utilizing this vulnerability may occur in the near future.

 

 

 

SYSTEMS AFFECTED:

 

 

• Windows 10
• Windows Server 2016, 2019
• Applications that rely on Windows for Trust functionality

 

 

 

RISK:

 

 

 

TECHNICAL SUMMARY:

 

 

A vulnerability has been discovered in The Microsoft Cryptographic library CRYPT32.DLL, which could allow for remote code execution. This spoofing vulnerability (CVE-2020-0601) exists due to the way the library Crypt32.dll validates the Elliptic Curve Cryptography certificates. Successful exploitation of this vulnerability could allow for attackers to compromise trusted network connections using spoofed certificates to deliver malicious executable code under the pretense of a legitimately trusted entity, commit man-in-the-middle attacks, and decrypt confidential information. Examples of potentially impacted services include HTTPS connections, signed emails and files, and user-mode processes launching signed executable code.

This vulnerability is included in the monthly Microsoft Patch Tuesday release.

 

 

 

RECOMMENDATIONS:

 

 

We recommend the following actions be taken:

 

• Rapid adoption of the patch is the only known mitigation at this time and is a paramount recommendation that all state, local, tribal, and territorial governments patch their respective systems after appropriate testing
• Reboot System after applying patches to complete remediation

 

 

 

 

REFERENCES: