Microsoft Windows Spoofing Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• EPSS: 39% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. The update addresses the vulnerability by correcting how Windows validates file signatures.

CISA: Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

• Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.htmlThird Party Advisory
• krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-yearsIssue TrackingThird Party Advisory
• medium.com/%40TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bdExploitThird Party Advisory
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464PatchVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource