PT-2023-27207 · Unknown · Uthenticode

D4Stiny · Published 2023-08-09 · Updated 2023-08-16 · CVE-2023-40012

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions uthenticode versions prior to 2.x

Description The issue concerns uthenticode, a library for partially verifying Authenticode digital signatures. It does not check Extended Key Usages in certificates, which is against the Authenticode X.509 certificate profile. This allows a malicious user to create a "signed" PE file that uthenticode would verify as valid, using an X.509 certificate not meant for code signatures, such as a SSL certificate. The library does not perform full-chain validation by design, but the lack of EKU validation was an oversight. The 2.0.0 release series includes EKU checks.

Recommendations For versions prior to 2.x, update to the 2.0.0 release series or later to include EKU checks. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-325

CWE-347

Related Identifiers

CVE-2023-40012

GHSA-GM2F-J4RJ-6XQJ

Affected Products

Uthenticode

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40012.json · Exploit
• https://github.com/trailofbits/uthenticode/commit/caeb1eb62412605f71bd96ce9bb9420644b6db53 · Patch
• https://github.com/trailofbits/uthenticode/pull/78 · Patch
• https://github.com/trailofbits/uthenticode/security/advisories/GHSA-gm2f-j4rj-6xqj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40012 · Security Note
• https://t.me/cibsecurity/68102 · Telegram Post