ALERT — Microsoft cryptography systems vulnerability
On 14 January, the National Security Agency (NSA) issued a notice detailing a vulnerability affecting Microsoft Windows systems (Windows 10, Windows Server 2016/2019).
The vulnerability (CVE-2020-0601) impacts certificate validation processes and may be exploited through multiple vectors and attack paths:
- HTTPS connections
- files and emails signed with certificates
- executables signed with certificates
Mitigation
We recommend maintaining current patch levels by applying the current month’s security updates as soon as possible, increasing monitoring intensity on critical systems and particularly on systems exposed to public networks. Organizations managing complex certificate infrastructures should consider engaging Cybersecurity Advisory resources to validate their validation chain implementations against this class of cryptographic bypass.
Sources
Microsoft Security Advisory:
