PT-2023-27181 · Unknown · Uthenticode

D4Stiny · Published 2023-08-09 · Updated 2023-08-16 · CVE-2023-39969

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions uthenticode version 1.0.9

Description uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rather than hashing sections by virtual address, in violation of the Authenticode specification. As a result, an attacker could modify code within a binary without changing its Authenticode hash, making it appear valid from uthenticode's perspective. By design, uthenticode does not perform full-chain validation. However, the malleability of signature verification introduced in 1.0.9 was an unintended oversight.

Recommendations For uthenticode version 1.0.9, upgrade to a version in the 2.x series to address the vulnerability. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-39969

GHSA-RC7G-99X7-4P9G

Affected Products

Uthenticode

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39969.json · Exploit
• https://github.com/trailofbits/uthenticode/security/advisories/GHSA-rc7g-99x7-4p9g · Vendor Advisory
• https://github.com/trailofbits/uthenticode/pull/84 · Patch
• https://github.com/trailofbits/uthenticode/commit/8670b7bb9154d79c276483dcb7c9e9fd5e66455b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-39969 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39969 · Vendor Advisory
• https://t.me/cibsecurity/68104 · Telegram Post