2064 matches found
Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2017-1225)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Exploit for Improper Certificate Validation in Microsoft
PoC exploit for CVE-2020-0601, a vulnerability in the signature verification of certificates using elliptic curve cryptography ECC in Windows 10. The exploit targets the MicrosoftECCProductRootCertificateAuthority.cer, a trusted root certificate authority CA using ECC. The vulnerability allows an...
CVE-2020-0601: Windows CryptoAPI Spoofing Vulnerability | Cloud Foundry
Severity High Vendor Microsoft Corporation Description A spoofing vulnerability exists in the way Windows CryptoAPI Crypt32.dll validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious...
The vulnerability in the programming interface of the Windows CryptoAPI (Crypt32.dll) on Windows operating systems allows attackers to circumvent existing security restrictions and execute a type of “man-in-the-middle” attack.
The vulnerability of the Windows CryptoAPI Crypt32.dll programming interface on Windows operating systems is related to errors in authenticating ECC certificates. Exploiting this vulnerability allows a remote attacker to circumvent existing security restrictions and execute a type of...
Exploit for Improper Certificate Validation in Microsoft
CurveBall CVE-2020-0601 - ECC/Po2 EXPLOIT CVE-2020-0601, or...
Using Live Query to Audit Your Environment for the Windows CryptoAPI Spoofing Vulnerability
This week, as part of its monthly patch Tuesday release, Microsoft disclosed an important security vulnerability CVE-2020-0601 affecting millions of Windows 10 and Windows Server 2016 & 2019 systems. More specifically, this vulnerability is a result of the way Windows CryptoAPI validates Elliptic...
PoC Exploits Published For Microsoft Crypto Bug
Two proof-of-concept PoC exploits have been publicly released for the recently-patched crypto-spoofing vulnerability found by the National Security Agency and reported to Microsoft. The vulnerability CVE-2020-0601 could enable an attacker to spoof a code-signing certificate necessary for validati...
Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft Windows is a Windows operating system released by Microsoft Corporation in the U.S. Microsoft CryptoAPI is a Windows Security Services API provided by Microsoft to developers for cryptographic applications to encrypt, decrypt, sign, and verify data. A spoofing vulnerability exists in...
Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing
EDB Note Download: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47933.zip require 'openssl' raw = File.read "ca.crt" cacert = OpenSSL::X509::Certificate.newraw Parse public key from CA cakey = cacert.publickey if !cakey.instanceof? OpenSSL::PKey::EC then puts...
Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing Certificate
EDB Note Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47933.zip require 'openssl' raw = File.read "ca.crt" cacert = OpenSSL::X509::Certificate.newraw Parse public key from CA cakey = cacert.publickey if !cakey.instanceof? OpenSSL::PKey::EC then puts "...
CVE-2020-0601
A spoofing vulnerability exists in the way Windows CryptoAPI Crypt32.dll validates Elliptic Curve Cryptography ECC certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted,...
CVE-2020-0601
A spoofing vulnerability exists in the way Windows CryptoAPI Crypt32.dll validates Elliptic Curve Cryptography ECC certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted,...
Update Windows 10 Immediately to Patch a Flaw Discovered by the NSA
After Adobe today releases its first Patch Tuesday updates for 2020, Microsoft has now also published its January security advisories warning billions of users of 49 new vulnerabilities in its various products. What's so special about the latest Patch Tuesday is that one of the updates fixes a...
USN-4236-2 libgcrypt20 vulnerability
USN-4236-1 fixed a vulnerability in Libgcrypt. This update provides the corresponding fix for Ubuntu 16.04 LTS. Original advisory details: It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use this attack to recover sensitive information...
VulnCheck KEV: CVE-2020-0601
Microsoft Windows CryptoAPI Crypt32.dll contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was...
PT-2020-1289
Name of the Vulnerable Software and Affected Versions Windows CryptoAPI Crypt32.dll versions prior to the fixed version Description A spoofing vulnerability exists in the way Windows CryptoAPI validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by...
USN-4236-1 libgcrypt20 vulnerability
It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use this attack to recover sensitive information...
Fedora Update for python-ecdsa FEDORA-2019-55e04129ac
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
The vulnerability of the p256-ECDH key generation function in browsers Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to induce a service failure.
The vulnerability of the p256-ECDH key generation function in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to a lack of mechanisms for verifying input data. Exploiting this vulnerability can allow an attacker to cause service failures...
