SB2022101144 - Spoofing attack in Microsoft Windows CryptoAPI
Published: October 11, 2022 Updated: January 27, 2023
Security Bulletin ID
SB2022101144
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Spoofing attack (CVE-ID: CVE-2022-34689)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in the Windows CryptoAPI. A remote attacker can manipulate an existing public x.509 certificate, spoof page content and and perform actions such as authentication or code signing as the targeted certificate.
Remediation
Install update from vendor's website.