PT-2023-27207 · Unknown · Uthenticode

D4Stiny · Publicado 2023-08-09 · Atualizado 2023-08-16 · CVE-2023-40012

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions uthenticode versions prior to 2.x

Description The issue concerns uthenticode, a library for partially verifying Authenticode digital signatures. It does not check Extended Key Usages in certificates, which is against the Authenticode X.509 certificate profile. This allows a malicious user to create a "signed" PE file that uthenticode would verify as valid, using an X.509 certificate not meant for code signatures, such as a SSL certificate. The library does not perform full-chain validation by design, but the lack of EKU validation was an oversight. The 2.0.0 release series includes EKU checks.

Recommendations For versions prior to 2.x, update to the 2.0.0 release series or later to include EKU checks. At the moment, there is no information about other workarounds for this issue.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-325

CWE-347

Identificadores relacionados

CVE-2023-40012

GHSA-GM2F-J4RJ-6XQJ

Produtos afetados

Uthenticode

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40012.json · Exploit
• https://github.com/trailofbits/uthenticode/commit/caeb1eb62412605f71bd96ce9bb9420644b6db53 · Correção
• https://github.com/trailofbits/uthenticode/pull/78 · Correção
• https://github.com/trailofbits/uthenticode/security/advisories/GHSA-gm2f-j4rj-6xqj · Aviso do Fabricante
• https://t.me/cibsecurity/68102 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40012 · Nota de Segurança