Cryptic Rumblings Ahead of First 2020 Patch Tuesday – Krebs on Security

Sources tell KrebsOnSecurity thatMicrosoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.

According to sources, the vulnerability in question resides in a Windows component known as crypt32.dll, a Windows module that Microsoft says handles certificate and cryptographic messaging functions in the CryptoAPI. The Microsoft CryptoAPIprovides services that enable developers to secure Windows-based applications using cryptography, and includes functionality for encrypting and decrypting data using digital certificates.

A critical vulnerability in this Windows component could have wide-ranging security implications for a number of important Windows functions, including authentication on Windows desktops and servers, the protection of sensitive data handled by Microsofts Internet Explorer/Edge browsers, as well as a number of third-party applications and tools.

Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. Such a weakness could be exploited by attackers to make malware appear to be a benign program that was produced and signed by a legitimate software company.

This component was introduced into Windows more than 20 years ago back in Windows NT 4.0. Consequently, all versions of Windows are likely affected (including Windows XP, which is no longer being supported with patches from Microsoft).

Microsoft has not yet responded to requests for comment. However, KrebsOnSecurity has heard rumblings from several sources over the past 48 hours that this Patch Tuesday (tomorrow) will include a doozy of an update that will need to be addressed immediately by all organizations running Windows.

Update 7:49 p.m. ET: Microsoft responded, saying that it does not discuss the details of reported vulnerabilities before an update is available. The company also said it does not release production-ready updates ahead of regular Update Tuesday schedule. Through our Security Update Validation Program (SUVP), we release advance versions of our updates for the purpose of validation and interoperability testing in lab environments, Microsoft said in a written statement. Participants in this program are contractually disallowed from applying the fix to any system outside of this purpose and may not apply it to production infrastructure.

Original story:

Will Dormann, a security researcher who authors many of the vulnerability reports for the CERT Coordination Center (CERT-CC), tweeted today that people should perhaps pay very close attention to installing tomorrows Microsoft Patch Tuesday updates in a timely manner. Even more so than others. I dont knowjust call it a hunch? Dormann declined to elaborate on that teaser.

It could be that the timing and topic here (cryptography) is nothing more than a coincidence, but KrebsOnSecurity today received a heads up from the U.S. National Security Agency (NSA) stating that NSAs Director of Cybersecurity Anne Neuberger is slated to host a call on Jan. 14 with the news media that will provide advanced notification of a current NSA cybersecurity issue.

The NSAs public affairs folks did not respond to requests for more information on the nature or purpose of the discussion. The invitation from the agency said only that the call reflects NSAs efforts to enhance dialogue with industry partners regarding its work in the cybersecurity domain.

Stay tuned for tomorrows coverage of Patch Tuesday and possibly more information on this particular vulnerability.

Tags: Anne Neuberger, CERT Coordination Center, CERT-CC, crypt32.dll, microsoft, Microsoft CryptoAPI, national security agency, nsa, Patch Tuesday January 2020, Will Dormann, windows

This entry was posted on Monday, January 13th, 2020 at 5:17 pmand is filed under Time to Patch.You can follow any comments to this entry through the RSS 2.0 feed.You can skip to the end and leave a comment. Pinging is currently not allowed.

Link:
Cryptic Rumblings Ahead of First 2020 Patch Tuesday - Krebs on Security