WinVerifyTrust

このリポジトリには README がありません。...

Fix-WinVerifyTrustSignatureValidationVuln

Fix-WinVerifyTrustSignatureValidationVuln Corrige la vulnerabilidad de validación de firma de WinVerifyTrust, CVE-2013-39001, QID-3783322 Esta corrección está pensada para computadoras Windows de 64 bits Este código de PowerShell es una forma de corregir la vulnerabilidad, además de crear un...

cve-2013-3900-remediation-report

修复报告：CVE-2013-3900 – Windows Server 2019（Azure VM）上的WinVerifyTrust漏洞 概述 在最近一次使用Tenable Nessus进行的经过身份验证的漏洞评估中，在托管于Microsoft Azure 的Windows Server 2019 虚拟机上检测到了CVE-2013-3900。此次扫描利用了管理员凭据，从而能够深入检查系统的配置和注册表设置。...

Remediating-CVE-2013-3900-EnableCertPaddingCheck-

修復レポート: CVE-2013-3900 on Windows Server 2019 Azure VM CVE-2013-3900 EnableCertPaddingCheck の修復 Tenable/Nessus を使用した認証済み脆弱性スキャン中に、Microsoft Azure でホストされている Windows Server 2019 Datacenter インスタンスで CVE-2013-3900 を特定しました。スキャンでは有効な管理資格情報を使用して詳細なチェックが実行され、OS レベルでこの脆弱性が存在することが確認されました。 CVE-2013-3900 は...

cve-2013-3900-winverifytrust-mitigation

CVE-2013-3900 緩和策 WinVerifyTrust / EnableCertPaddingCheck このリポジトリには、Tenable/Nessus の検出項目に対処する PowerShell の修復＋検証スクリプトが含まれています。 プラグイン ID: 166555 名前: WinVerifyTrust 署名検証 CVE-2013-3900 の緩和策 EnableCertPaddingCheck このスクリプトは、次の設定を行うことで WinVerifyTrust の証明書パディングチェックを強制します。 EnableCertPaddingCheck DWORD = 1...

-WinVerifyTrust-Signature-Validation-CVE-2013-3900-Mitigation

CVE-2013-3900 是微软 WinVerifyTrust 函数处理 Windows Authenticode 签名验证方式中的一个远程代码执行漏洞。此缺陷允许攻击者修改已签名的可执行文件，通过在文件未经验证的部分添加恶意代码而不使其签名失效。 此漏洞的缓解措施是一项需要特定注册表设置的可选功能。启用后，Windows 将对 Authenticode 签名执行更严格的验证，确保签名文件中不存在无关数据。 -WinVerifyTrust-签名验证-CVE-2013-3900-缓解 Define the registry key paths $regPath32 =...

vulnerability-remediation-cve-2013-3900

🛡️ CVE-2013-3900 修复：WinVerifyTrust 签名验证 📝 项目概述 本项目演示了一个真实的漏洞管理工作流程 。通过使用Azure VM，我追踪了一个高严重性的签名验证漏洞，通过PowerShell手动确认，并部署了基于注册表的修复措施，以加固系统防止未经授权的代码执行。 问题 Windows中的WinVerifyTrust 函数存在一个隐蔽漏洞（CVE-2013-3900）。攻击者可以将恶意代码“搭便车”到已签名的文件上而不会破坏数字签名。这意味着即使文件携带恶意代码，它也可能看起来是“可信的”，从而绕过安全检查。 🚨 发现 我首先在Azure...

Proactively Managing High-Risk Vulnerabilities with TruRisk Mitigate™

In late 2024, organizations faced over 65 million detections from three critical vulnerabilities—CVE-2013-2900, CVE-2024-38122, and CVE-2024-30078—underscoring the urgent need for proactive vulnerability management. Adding to these challenges, the Qualys Threat Research Unit TRU uncovered five...

The vulnerability of the WinVerifyTrust function in the Windows operating system, allowing a hacker to execute arbitrary code

The vulnerability of the WinVerifyTrust function in the Windows operating system is related to improper validation of PE files during the verification of Authenticode signatures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created signed PE...

WinVerifyTrust Signature Validation Vulnerability

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the forma...

Microsoft WinVerifyTrust function Remote Code Execution

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files...

Update for SIP to enable WinVerifyTrust function in Windows Server 2008 R2 SP1 to work with a later version of Windows

Update for SIP to enable WinVerifyTrust function in Windows Server 2008 R2 SP1 to work with a later version of Windows About this update Subject Interface Packages SIPs are required in order to read the digital signatures on specific file types. After you install this update, SIPs enable the...

VulnCheck KEV: CVE-2013-3900

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files...

Microsoft Windows WinVerifyTrust PE Validation Security Bypass (MS13-098; CVE-2013-3900)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable PE files. A remote attacker could trigger this flaw by sending a...

CVE-2013-3900

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the forma...

Input validation

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during...

Microsoft WinVerifyTrust Signature Validation Vulnerability (2893294)

This host is missing a critical security update according to Microsoft Bulletin MS13-098. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2013-3900 WinVerifyTrust Signature Validation Vulnerability

...

MS13-098: Vulnerability in Windows Could Allow Remote Code Execution (2893294)

The remote host contains a version of Microsoft Windows that is affected by a remote code execution vulnerability. The vulnerability exists in the method in which the WinVerifyTrust function deals with Windows Authenticode signature verification for portable executable files. An attacker could...

CVE-2013-3900

CVE-2013-3900 describes a remote code execution in the WinVerifyTrust Authenticode verification for PE files. An attacker could modify a signed executable to execute code without invalidating the signature, potentially gaining full control of the system. Microsoft republished this CVE in the Secu...