Today Microsoft has released patches for 49 vulnerabilities in total. Extra attention was directed to vulnerability in Windows CryptoAPI implementation, tracked as SB2020011424 (CVE-2020-0601), given that media just before the initial patch released have started speculating on its impact. Additional interest was also caused by the organization, that reported this vulnerability to Microsoft: that was NSA(!).

The vulnerability in question present in the Windows usermode cryptographic library, CRYPT32.DLL, on Windows 10, Windows Server 2016, and Windows Server 2019 systems. As per Microsoft’s description, “a spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates”.

CVE-2020-0601 could be exploited by an attacker using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. Furthermore, the user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider. Microsoft says that this flaw could allow the attacker to launch man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

The software giant says it has not detected attacks in the wild exploiting the CVE-2020-0601 bug, and it has marked the flaw as “Important”, not “Critical”, but in its own press-release the NSA has warned that it “assesses the vulnerability to be severe” and “that sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, would render the previously mentioned platforms as fundamentally vulnerable”. To mitigate the threat the agency recommends to install all January 2020 Patch Tuesday patches as soon as possible.

All 49 vulnerabilities were combined into 26 security bulletins, grouped by vulnerable components and issued by Cybersecurity Help. For each vulnerability we assign a risk level, based on our primary analysis.

11 vulnerabilities were rated as Highly critical, 6 vulnerabilities as Medium and 32 vulnerabilities had a Low risk assigned.

18 vulnerabilities can be exploited remotely, 30 vulnerabilities locally and 1 vulnerability requires physical access to the system.

The majority of patched issues (27 out of 49) are boundary errors. 10 vulnerabilities were caused by improper input validation, 4 issues are related to privilege management, as shown below:

Below is a table with the list of all vulnerabilities, patched by Microsoft in January 2020.