Windows CryptoAPI ECC Certificate Spoofing Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, if a user is tricked into opening a malicious file or link, can steal data and tamper with data.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Implement stringent application whitelisting policies that validate not just the presence of a code signature, but also the full certificate chain against known, trusted roots and specific publishers. Enhance network and endpoint detection systems to monitor for unusual executable behavior or suspicious process activity, even if the executable appears signed. Educate users about the risks of running executables from unknown sources, regardless of their perceived legitimacy.
Apply the security updates released by Microsoft for CVE-2020-0601 immediately to all affected Windows operating systems. These patches specifically correct the flaw in Crypt32.dll's Elliptic Curve Cryptography (ECC) certificate validation logic, preventing the spoofing technique. Ensure all systems are updated to the latest secure versions to permanently resolve this vulnerability.
An attacker can sign malicious executables with a spoofed code-signing certificate, making the malware appear to originate from a trusted, legitimate source. This circumvents security controls like application whitelisting and user trust, potentially leading to widespread malware infections, system compromise, and data theft. Successful exploitation could grant attackers persistent access and control over affected systems.
Other CVEs affecting go
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.