Overview
The Microsoft Windows CryptoAPI fails to properly validate certificates that use Elliptic Curve Cryptography (ECC), which may allow an attacker to spoof the validity of certificate chains.
Description
The Microsoft Windows CryptoAPI, which is provided by Crypt32.dll, fails to validate ECC certificates in a way that properly leverages the protections that ECC cryptography should provide. As a result, an attacker may be able to craft a certificate that appears to have the ability to be traced to a trusted root certificate authority. Any software, including third-party non-Microsoft software, that relies on the Windows CertGetCertificateChain() function to determine if an X.509 certificate can be traced to a trusted root CA may incorrectly determine the trustworthiness of a certificate chain. |
Impact
By exploiting this vulnerability, an attacker may be able to spoof a valid X.509 certificate chain on a vulnerable Windows system. This may allow various actions including, but not limited to, interception and modification of TLS-encrypted communications or spoofing an Authenticode signature. |
Solution
Apply an update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 9.4 | AV:N/AC:L/Au:N/C:C/I:C/A:N |
| Temporal | 9.4 | E:ND/RL:U/RC:C |
| Environmental | 9.4 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
References
- https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2056772/a-very-important-patch-tuesday/
- https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
- https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptoapi-system-architecture
- https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certgetcertificatechain
- https://docs.microsoft.com/en-us/windows/win32/seccrypto/certificate-chains
- https://docs.microsoft.com/en-us/windows-hardware/drivers/install/authenticode
Acknowledgements
This issue was disclosed by Microsoft, who in turn credit the National Security Agency (NSA).
This document was written by Will Dormann.
Other Information
| CVE IDs: | CVE-2020-0601 |
| Date Public: | 2020-01-14 |
| Date First Published: | 2020-01-14 |
| Date Last Updated: | 2020-01-15 00:03 UTC |
| Document Revision: | 37 |