Security News > 2020 > January > January 2020 Patch Tuesday: Microsoft nukes Windows crypto flaw flagged by the NSA

January 2020 Patch Tuesday: Microsoft nukes Windows crypto flaw flagged by the NSA
2020-01-14 20:18

As forecasted, January 2020 Patch Tuesday releases by Microsoft and Adobe are pretty light: the "Star of the show" is CVE-2020-0601, a Windows flaw flagged by the NSA that could allow attackers to successfully spoof code-signing certificates and use them to sign malicious code or intercept and modify encrypted communications.

The flaw only affects newer versions of Windows and Windows Server, and is found in the Windows CryptoAPI, which validates Elliptic Curve Cryptography certificates.

The security update fixes it and creates a new entry in the Windows event logs if an attacker attempts to use a forged certificate against a patched system.

It goes without saying that admins should prioritize this security update for Windows 10, Windows Server 2016 and 2019.

Users who still use Windows 7, Windows Server 2008 R2, and Windows Server 2008 are reminded once more that support for those ends today and that the patches for them released today, covering 22 CVEs, are the last they'll get for free.


News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/6xsDlL9LxAI/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2020-01-14 CVE-2020-0601 Improper Certificate Validation vulnerability in multiple products
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
network
low complexity
microsoft golang CWE-295
8.1

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Microsoft 480 75 2308 5127 264 7774
NSA 2 0 2 7 5 14