Microsoft to patch ‘extraordinarily serious’ cryptographic flaw
The fix has already been shipped to high-value organisations like the US military, according to reports
Microsoft is expected to patch a critical security vulnerability found within a core cryptographic component in several iterations of its Windows operating system as part of its first Patch Tuesday of 2020.
The software update is slated to fix an “extraordinarily serious” flaw anchored in the crypt32.dll Windows component, according to security researcher Brian Krebs, who has had conversations with sources with knowledge of the vulnerability.
This vulnerability involves the cryptographic elements of Windows, including data encryption, and as such would be considered highly dangerous if exploited.
Organisations like the US military and firms directly tied with critical infrastructure, moreover, have reportedly been shipped the patch already. They have also allegedly been asked to sign agreements preventing disclosure prior to its public release.
Crypt32.dll has been a part of Windows OS releases for more than 20 years and is a core module that handles certificate and cryptographic messaging functions in the CryptoAPI.
RELATED RESOURCE
This API offers developers the capacity to secure Windows-based applications with cryptography, including encrypting and decrypting data via digital certificates.
These CryptoAPI functions also include the CryptSignMessage function, which creates a hash of specific content, signs the hash, then encodes both the original message content and the signed hash.
The wide-reaching nature of the security implications, according to Krebs, ranges from compromising authentication on Windows desktops on servers to the protection of sensitive data.
Exploiting the flaw could also allow an attacker to spoof digital signatures, meaning malicious applications can be made to carry the known fingerprint of a legitimate developer.
Microsoft responded by suggesting it doesn’t discuss details of any flaws before updates are made available. The firm added it does not release production-ready updates ahead of regular Update Tuesday schedule.
“We follow the principles of coordinated vulnerability disclosure (CVD) as the industry best practice to protect our customers from reported security vulnerabilities," senior director with Microsoft, Jeff Jones, told IT Pro.
"To prevent unnecessary risk to customers, security researchers and vendors do not discuss the details of reported vulnerabilities before an update is available.
"At 10am PT, we will release this month’s updates and technical information as part of our regular Update Tuesday schedule.”
A Microsoft spokesperson added that it releases advanced versions of its updates to certain organisations through its Security Update Validation Program (SUVP) for testing purpoes. Participants in this scheme are not allowed to apply the fix to any system beyond this purpose.
The initial reports were partially corroborated by Will Dormann, a vulnerability analyst with the Carnegie Mellon Software Engineering Institute’s computer emergency response team, tweeted that people should pay “very close attention” to the forthcoming round of updates.
Given crypt32.dll has been a part of Windows since Windows NT 4.0, the flaw is likely to be embedded in all previous iterations of the OS released since, including Windows 10, and legacy systems like Windows 7 and Windows XP.
Krebs added the NSA’s director of cybersecurity Anne Neuberger may host a call regarding a “current NSA cybersecurity issue”, which will coincide with the first Patch Tuesday of 2020.
IT Pro approached Microsoft for further information around the reported vulnerability and plans to release a patch.
-
What might cause the 'AI bubble' to burst?In-depth If a bubble is really forming, what happens to the businesses caught up in the AI craze when it pops – and why things might not be as bad as they seem
-
London set to host OpenAI's largest research hub outside USNews OpenAI wants to capitalize on the UK’s “world-class” talent in areas such as machine learning
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
