CIS Logo
tagline: Confidence in the Connected World

A Vulnerability in the Microsoft Cryptographic Library CRYPT32.DLL Could Allow for Remote Code Execution

MS-ISAC ADVISORY NUMBER:

2020-005

DATE(S) ISSUED:

01/14/2020

OVERVIEW:

A vulnerability has been discovered in the Microsoft Cryptographic library CRYPT32.DLL, which could allow for remote code execution. The Microsoft Cryptographic library CRYPT32.DLL is the module that implements many of the certificate and cryptographic messaging functions in the CryptoAPI. This library comes with the Windows and Windows Server Operating Systems. Successful exploitation of this vulnerability could allow for attackers to compromise trusted network connections using spoofed certificates. This can be used to deliver malicious executable code under the pretense of a legitimately trusted entity, commit man-in-the-middle attacks, and decrypt confidential information. Examples of potentially impacted services include HTTPS connections, signed emails and files, and user-mode processes launching signed executable code.

THREAT INTELLIGENCE:

There is currently no report of this vulnerability being exploited in the wild. CISA anticipates that attempted exploits utilizing this vulnerability may occur in the near future.

January 16 – UPDATED THREAT INTELLIGENCE:
On January 16, security researchers from Kudelski Security and Ollypwn published PoC for CVE-2020-0601 to GitHub. A third PoC exploit has reportedly been developed but was not released to the public.

SYSTEMS AFFECTED:

  • Windows 10
  • Windows Server 2016, 2019
  • Applications that rely on Windows for Trust functionality

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in The Microsoft Cryptographic library CRYPT32.DLL, which could allow for remote code execution. This spoofing vulnerability (CVE-2020-0601) exists due to the way the library Crypt32.dll validates the Elliptic Curve Cryptography certificates. Successful exploitation of this vulnerability could allow for attackers to compromise trusted network connections using spoofed certificates to deliver malicious executable code under the pretense of a legitimately trusted entity, commit man-in-the-middle attacks, and decrypt confidential information. Examples of potentially impacted services include HTTPS connections, signed emails and files, and user-mode processes launching signed executable code.

This vulnerability is included in the monthly Microsoft Patch Tuesday release.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Rapid adoption of the patch is the only known mitigation at this time and is a paramount recommendation that all state, local, tribal, and territorial governments patch their respective systems after appropriate testing
  • Reboot System after applying patches to complete remediation

REFERENCES:

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0

Pencil Media mention 21 Jan 2020
CONTROL: 3 --- ADVISORY CONTROL: 0
CONTROL: 4 --- ADVISORY CONTROL: 0