# MA-764.012020: MyCERT Advisory - Microsoft Windows CryptoAPI fails to properly validate ECC certificate chains

**Date:** 16 Jan 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-764.012020  
**Advisory ID:** MA-764.012020

---

**1.0 Introduction**
Microsoft Windows CryptoAPI fails to properly validate certificates that use Elliptic Curve Cryptography (ECC) that let an attacker to spoof the validity of digital certificate. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.
**2.0 Impact**
A successful exploit could allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.
**3.0 Affected Products**
- Windows 10 operating system (32 and 64 bit)
- Windows Server 2016
- Windows Server 2019
**4.0 Recommendations**
MyCERT highly recommended users to install all January 2020 Security Updates patches to effectively mitigate the vulnerability on all Windows 10, Windows Server 2016 and Windows Server 2019 systems.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Jan
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
- https://kb.cert.org/vuls/id/849224/
- https://www.us-cert.gov/ncas/alerts/aa20-014a