{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability","@odata.count":1,"value":[{"id":"00000000-0000-0000-0000-00009fc134ce","releaseDate":"2020-01-14T08:00:00Z","cveNumber":"CVE-2020-0601","cveTitle":"Windows CryptoAPI Spoofing Vulnerability","releaseNumber":"2020-Jan","vulnType":"Security Vulnerability","latestRevisionDate":"2020-01-16T08:00:00Z","description":"<p>A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.</p>\n<p>An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.</p>\n<p>A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.</p>\n<p>The security update addresses the vulnerability by ensuring that Windows CryptoAPI completely validates ECC certificates.</p>\n","cweList":[],"cweDetailsListForSearch":[],"mitreText":"CVE-2020-0601","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2020-0601","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":1,"latestSoftwareRelease":"Exploitation More Likely","olderSoftwareReleaseId":1,"olderSoftwareRelease":"Exploitation More Likely","denialOfService":"N/A","tag":"Microsoft Windows","issuingCnaId":0,"severityId":0,"impactId":0,"langCode":"en-US","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":0,"cweDetailsList":[],"articles":[{"articleType":"FAQ","description":"<p><strong>How can I tell is someone is attempting to use a forged certificate to exploit this vulnerability?</strong></p>\n<ol>\n<li>After the applicable Windows update is applied, the system will generate Event ID 1 in the Event Viewer after each reboot under Windows Logs/Application when an attempt to exploit a known vulnerability ([CVE-2020-0601] cert validation) is detected.</li>\n<li>This Event is raised by a User mode process.</li>\n</ol>\n<table>\n<thead>\n<tr>\n<th>Type</th>\n<th>Value</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Event Log</td>\n<td>Windows Logs/Application</td>\n</tr>\n<tr>\n<td>Event Source</td>\n<td>Audit-CVE</td>\n</tr>\n<tr>\n<td>Event ID</td>\n<td>1</td>\n</tr>\n<tr>\n<td>Certificate Authority</td>\n<td>Microsoft ECC Product Root Certificate Authority 2018</td>\n</tr>\n<tr>\n<td>SHA1</td>\n<td>This data is specific to the certificate in question</td>\n</tr>\n<tr>\n<td>Para</td>\n<td>This data is specific to the certificate in question</td>\n</tr>\n<tr>\n<td>otherPara</td>\n<td>This data is specific to the certificate in question</td>\n</tr>\n</tbody>\n</table>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>Is there more information from Microsoft regarding CVE-2020-0601?</strong></p>\n<p>Yes, please see the <a href=\"https://msrc-blog.microsoft.com/2020/01/14/january-2020-security-updates:-cve-2020-0601/\">blog post</a> released on 1/14/2020.</p>\n<p><strong>Are versions older than Windows 10 versions affected by this vulnerability?</strong></p>\n<p>No, only Windows 10 versions of the OS are affected.  In the initial release of Windows 10 (Build 1507, TH1), Microsoft added support for ECC parameters configuring ECC curves. Prior to this, Windows only supported named ECC curves. The code which added support for ECC parameters also resulted in the certificate validation vulnerability. It was not a regression, and versions of Windows which don\u2019t support ECC parameters configuring ECC curves (Server, 2008, Windows 7, Windows 8.1 and servers) were not affected.</p>\n","ordinal":10000}],"revisions":[{"version":1,"revisionDate":"2020-01-14T08:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","notificationNeeded":false,"notificationSent":false},{"version":1.2,"revisionDate":"2020-01-16T08:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Added FAQ information. This is an informational change only.</p>\n","notificationNeeded":false,"notificationSent":false},{"version":1.1,"revisionDate":"2020-01-14T08:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Added an FAQ. This is an information change only.</p>\n","notificationNeeded":false,"notificationSent":false}]}]}