Threat Brief: Windows CryptoAPI Spoofing Vulnerability CVE-2020-0601
Summary: Microsoft's January 2020 Patch Tuesday fixed 17 vulnerabilities, including CVE-2020-0601, known as Curveball, a flaw in the Windows CryptoAPI (Crypt32.dll) tied to how Elliptic Curve Cryptography certificates are validated. Microsoft said at release it had not seen the vulnerability exploited in the wild, and the patch added a new API function, CveEventWrite, that publishes events when exploitation of user-mode vulnerabilities is attempted.
Why it matters: The patch shipped a detection hook, CveEventWrite, so analysts can hunt for the Application Message 'CVE-2020-0601' on patched systems - meaning the fix also depends on someone actually collecting those alerts.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-0601
- Related
- CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Patch Tuesday, January 2020 Edition Cyber Risks ·