uthenticode 1.0.9 signature verification

Summaryinfo

A vulnerability was found in uthenticode 1.0.9. It has been classified as problematic. The impacted element is an unknown function. Performing a manipulation results in signature verification. This vulnerability is identified as CVE-2023-39969. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in uthenticode 1.0.9. It has been classified as problematic. This affects an unknown code block. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on integrity. The summary by CVE is:

uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rather than hashing sections by virtual address, in violation of the Authenticode specification. As a result, an attacker could modify code within a binary without changing its Authenticode hash, making it appear valid from uthenticode's perspective. Versions of uthenticode prior to 1.0.9 are not vulnerable to this attack, nor are versions in the 2.x series. By design, uthenticode does not perform full-chain validation. However, the malleability of signature verification introduced in 1.0.9 was an unintended oversight. The 2.x series addresses the vulnerability. Versions prior to 1.0.9 are also not vulnerable, but users are encouraged to upgrade rather than downgrade. There are no workarounds to this vulnerability.

The weakness was released 08/09/2023 as GHSA-rc7g-99x7-4p9g. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-39969 since 08/07/2023. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.0.9 or 2.0 eliminates this vulnerability. Applying the patch 8670b7bb9154d79c276483dcb7c9e9fd5e66455b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• uthenticode

Version

• 1.0.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion