// For flags

CVE-2020-0601

Microsoft Windows CryptoAPI Spoofing Vulnerability

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

15
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Se presenta una vulnerabilidad de suplantación de identidad en la manera en que Windows CryptoAPI (Crypt32.dll) comprueba los certificados Elliptic Curve Cryptography (ECC). Un atacante podría explotar la vulnerabilidad mediante el uso de un certificado de firma de código falsificado para firmar un ejecutable malicioso, haciendo que parezca que el archivo era de una fuente confiable y legítima, también se conoce como "Windows CryptoAPI Spoofing Vulnerability".

Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-11-04 CVE Reserved
  • 2020-01-14 CVE Published
  • 2020-01-14 First Exploit
  • 2020-01-29 KEV Due Date
  • 2021-11-03 Exploited in Wild
  • 2024-08-04 CVE Updated
  • 2024-11-03 EPSS Updated
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Golang
Search vendor "Golang"
Go
Search vendor "Golang" for product "Go"
>= 1.12 < 1.12.16
Search vendor "Golang" for product "Go" and version " >= 1.12 < 1.12.16"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
--
Safe
Golang
Search vendor "Golang"
Go
Search vendor "Golang" for product "Go"
>= 1.13 < 1.13.7
Search vendor "Golang" for product "Go" and version " >= 1.13 < 1.13.7"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
--
Safe
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
--
Affected
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
1607
Search vendor "Microsoft" for product "Windows 10" and version "1607"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
1709
Search vendor "Microsoft" for product "Windows 10" and version "1709"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
1803
Search vendor "Microsoft" for product "Windows 10" and version "1803"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
1809
Search vendor "Microsoft" for product "Windows 10" and version "1809"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
1903
Search vendor "Microsoft" for product "Windows 10" and version "1903"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows 10
Search vendor "Microsoft" for product "Windows 10"
1909
Search vendor "Microsoft" for product "Windows 10" and version "1909"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows Server 2016
Search vendor "Microsoft" for product "Windows Server 2016"
--
Affected
Microsoft
Search vendor "Microsoft"
Windows Server 2016
Search vendor "Microsoft" for product "Windows Server 2016"
1803
Search vendor "Microsoft" for product "Windows Server 2016" and version "1803"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows Server 2016
Search vendor "Microsoft" for product "Windows Server 2016"
1903
Search vendor "Microsoft" for product "Windows Server 2016" and version "1903"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows Server 2016
Search vendor "Microsoft" for product "Windows Server 2016"
1909
Search vendor "Microsoft" for product "Windows Server 2016" and version "1909"
-
Affected
Microsoft
Search vendor "Microsoft"
Windows Server 2019
Search vendor "Microsoft" for product "Windows Server 2019"
--
Affected