CVE-2020-0601
Microsoft Windows CryptoAPI Spoofing Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
15Exploited in Wild
YesDecision
Descriptions
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Se presenta una vulnerabilidad de suplantación de identidad en la manera en que Windows CryptoAPI (Crypt32.dll) comprueba los certificados Elliptic Curve Cryptography (ECC). Un atacante podría explotar la vulnerabilidad mediante el uso de un certificado de firma de código falsificado para firmar un ejecutable malicioso, haciendo que parezca que el archivo era de una fuente confiable y legítima, también se conoce como "Windows CryptoAPI Spoofing Vulnerability".
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-11-04 CVE Reserved
- 2020-01-14 CVE Published
- 2020-01-14 First Exploit
- 2020-01-29 KEV Due Date
- 2021-11-03 Exploited in Wild
- 2024-08-04 CVE Updated
- 2024-11-03 EPSS Updated
CWE
- CWE-295: Improper Certificate Validation
CAPEC
References (18)
URL | Tag | Source |
---|---|---|
http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html | Third Party Advisory | |
http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/47933 | 2020-01-15 | |
https://github.com/eastmountyxz/CVE-2020-0601-EXP | 2020-02-17 | |
https://github.com/IIICTECH/-CVE-2020-0601-ECC---EXPLOIT | 2020-01-19 | |
https://github.com/RrUZi/Awesome-CVE-2020-0601 | 2020-02-02 | |
https://github.com/nissan-sudo/CVE-2020-0601 | 2020-01-14 | |
https://github.com/BlueTeamSteve/CVE-2020-0601 | 2020-02-03 | |
https://github.com/yanghaoi/CVE-2020-0601 | 2021-04-08 | |
https://github.com/MarkusZehnle/CVE-2020-0601 | 2020-01-17 | |
https://github.com/YoannDqr/CVE-2020-0601 | 2020-01-20 | |
https://github.com/SherlockSec/CVE-2020-0601 | 2020-01-15 | |
https://github.com/JPurrier/CVE-2020-0601 | 2020-01-17 | |
https://github.com/Ash112121/CVE-2020-0601 | 2020-01-20 | |
https://github.com/exploitblizzard/CVE-2020-0601-spoofkey | 2021-03-14 | |
https://github.com/cimashiro/-Awesome-CVE-2020-0601- | 2023-04-04 | |
https://github.com/okanulkr/CurveBall-CVE-2020-0601-PoC | 2021-03-27 |
URL | Date | SRC |
---|---|---|
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 | 2022-08-12 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | >= 1.12 < 1.12.16 Search vendor "Golang" for product "Go" and version " >= 1.12 < 1.12.16" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | >= 1.13 < 1.13.7 Search vendor "Golang" for product "Go" and version " >= 1.13 < 1.13.7" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | - | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | 1607 Search vendor "Microsoft" for product "Windows 10" and version "1607" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | 1709 Search vendor "Microsoft" for product "Windows 10" and version "1709" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | 1803 Search vendor "Microsoft" for product "Windows 10" and version "1803" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | 1809 Search vendor "Microsoft" for product "Windows 10" and version "1809" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | 1903 Search vendor "Microsoft" for product "Windows 10" and version "1903" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows 10 Search vendor "Microsoft" for product "Windows 10" | 1909 Search vendor "Microsoft" for product "Windows 10" and version "1909" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows Server 2016 Search vendor "Microsoft" for product "Windows Server 2016" | - | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows Server 2016 Search vendor "Microsoft" for product "Windows Server 2016" | 1803 Search vendor "Microsoft" for product "Windows Server 2016" and version "1803" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows Server 2016 Search vendor "Microsoft" for product "Windows Server 2016" | 1903 Search vendor "Microsoft" for product "Windows Server 2016" and version "1903" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows Server 2016 Search vendor "Microsoft" for product "Windows Server 2016" | 1909 Search vendor "Microsoft" for product "Windows Server 2016" and version "1909" | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Windows Server 2019 Search vendor "Microsoft" for product "Windows Server 2019" | - | - |
Affected
|