CVE-2013-3900 WinVerifyTrust Signature Validation Vulnerability

Question

Hi All

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900

To remediate the vulnerability CVE-2013-3900 is to add the below registry values.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

1. On Windows servers 2016/2019 i dont see the folders Wintrust\Config in registries. do i need to create these folders and the registry value EnableCertPaddingCheck"=1.
2. using powershell script i have created Wintrust & config folder and added EnableCertPaddingCheck"="1" , Is Reg_SZ type correct?
   3. {Default}-Reg_SZ also got created, will this create any issue.

Answer 1

Using the REG file examples a REG_SZ will be created by default so yes it would be correct.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

According to this article: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-098

Windows server 2016, 2019 and 2022 are not in the list of affected products.

So, I still need to apply remediation steps on windows server 2016, 2019 and 2022 for CVE-2013-3900 vulnerability ?

Waiting for your prompt response

Answer 3

1. Make the .reg from the entries below.
2. Transfer it to the user's machine and run.

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config] "EnableCertPaddingCheck"="1" [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config] "EnableCertPaddingCheck"="1"

Answer 4

Anyone looking to do this, can use below code

Impact of enabling the functionality change: Non-conforming binaries will appear unsigned and, therefore, be rendered untrusted.

#Source https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900

if (!(Test-Path 'HKLM:\Software\Microsoft\Cryptography\Wintrust')) {

New-Item -Path 'HKLM:\Software\Microsoft\Cryptography' -Name 'Wintrust' | Out-Null

}

if (!(Test-Path 'HKLM:\Software\Microsoft\Cryptography\Wintrust\Config')) {

New-Item -Path 'HKLM:\Software\Microsoft\Cryptography\Wintrust' -Name 'Config' | Out-Null

}

Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Cryptography\Wintrust\Config' -Name 'EnableCertPaddingCheck' -Value '1' -Type DWORD

if (!(Test-Path 'HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust')) {

New-Item -Path 'HKLM:\Software\Wow6432Node\Microsoft\Cryptography' -Name 'Wintrust' | Out-Null

}

if (!(Test-Path 'HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config')) {

New-Item -Path 'HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust' -Name 'Config' | Out-Null

}

Set-ItemProperty -Path 'HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config' -Name 'EnableCertPaddingCheck' -Value '1' -Type DWORD

Write-Output 'Please reboot your system to apply the changes.'