One of the most notable vulnerabilities patched during Microsoft's first Patch Tuesday of 2020 was a spoofing vulnerability in the Windows CryptoAPI. This has been issued CVE-2020-0601 and has also been referred to as the "Curveball" or "Chain of Fools" vulnerability.

Jan 14, 2020 · The CryptoAPI is what enables developers to secure Windows-based applications and any critical vulnerability here could impact encryption and decryption using digital certificates. Apr 08, 2020 · One very notable bug that was disclosed was CVE-2020-0601 (also known as "Curveball")- a Windows CryptoAPI Spoofing vulnerability in the way Elliptic Curve Cryptography (ECC) certificates are validated. Exploitation of this could allow an attacker to sign a malicious executable using a spoofed code-signing certificate (appearing legitimate), leading to a man-in-the-middle (MITM) attack and decryption of confidential information. Jan 16, 2020 · These include Windows 10, Windows Server 2016 and Windows Server 2019. In its advisory , the NSA said the CryptoAPI vulnerability could lead to remote code execution and the ability to defeat Jan 17, 2020 · The vulnerability exists in the Windows CryptoAPI (Crypt32.dll) and specifically relates to the method used for Elliptic Curve Cryptography (ECC) certificate validation. At the time of release, Microsoft affirmed that they had not yet seen the vulnerability exploited in the wild (ITW).

The read-only Window.crypto property returns the Crypto object associated to the global object. This object allows web pages access to certain cryptographic related services.

Jan 14, 2020 · Today, Microsoft released patch for CVE-2020-0601, aka Curveball, a vulnerability in windows “crypt32.dll” component that could allow attackers to perform spoofing attacks. This was discovered and reported by National Security Agency (NSA) Researchers. The vulnerability affects Windows 10 and Windows Server 2016/2019 systems. The following topics provide information about using cryptography. These procedures and examples demonstrate CryptoAPI, CAPICOM, and Certificate Services tasks. The examples use cryptographic function calls, interfaces, and objects described in the Cryptography Reference.

Jan 27, 2020 · Overview On January 14, local time, one of the latest monthly patch updates from Microsoft fixed the Windows CryptoAPI spoofing vulnerability (CVE-2020-0601) discovered and reported to Microsoft by the National Security Agency (NSA), which affects Windows 10. , Windows Server 2016 and Windows Server 2019. According to a bulletin issued by Microsoft, this security […]

Jan 14, 2020 · Description. The Microsoft Windows CryptoAPI, which is provided by Crypt32.dll, fails to validate ECC certificates in a way that properly leverages the protections that ECC cryptography should provide. As a result, an attacker may be able to craft a certificate that appears to have the ability to be traced to a trusted root certificate authority. Any software, including third-party non-Microsoft software, that relies on the Windows CertGetCertificateChain () function to determine if an X.509