What is CVE-2020-0601?

CVE-2020-0601, also known as the Windows CryptoAPI Spoofing Vulnerability, is a high-severity issue affecting various versions of Microsoft Windows and Windows Server operating systems. This vulnerability allows attackers to exploit the way Windows validates Elliptic Curve Cryptography (ECC) certificates, enabling them to use spoofed code-signing certificates to make malicious files appear legitimate. As a result, users of affected systems are at risk of man-in-the-middle attacks and potential execution of malicious code on their devices.

Who is impacted by this?

Affected versions include all Microsoft Windows 10 versions (1607, 1709, 1803, 1809, 1903, and 1909), Microsoft Windows Server 2016 (1803, 1903, and 1909), Microsoft Windows Server 2019, and Golang Go versions 1.12 to 1.12.16 and 1.13 to 1.13.7 running on Microsoft Windows. This vulnerability allows attackers to use spoofed certificates to make malicious files appear legitimate, putting users at risk of man-in-the-middle attacks and potential execution of malicious code on their devices.

What should I do if I’m affected?

If you're affected by the CVE-2020-0601 vulnerability, it's crucial to take action to protect your system. Follow these simple steps:

1. Update your Windows operating system to the latest version, which includes a security patch addressing the vulnerability.

2. Ensure your antivirus software is up-to-date and regularly scan your system for potential threats.

3. Be cautious when downloading files and opening email attachments, even if they appear to be from trusted sources.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2020-0601 vulnerability, also known as the Microsoft Windows CryptoAPI Spoofing Vulnerability, is included in CISA's Known Exploited Vulnerabilities Catalog. It was added on November 3, 2021, and the required action is to apply updates according to vendor instructions. The due date for addressing this vulnerability was January 29, 2020.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-295, which involves improper certificate validation in Windows CryptoAPI.

Learn More

For a comprehensive understanding of this vulnerability, consult the NVD page and the resources listed below.

• CurveBall Microsoft Windows CryptoAPI Spoofing Proof Of Concept

• CVE-2020-0601 - Security Update Guide - Microsoft

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA