Windows 10: MSR JavaScript Cryptography Library Security Vulnerability

Brink · Jul 16, 2018

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.

An attacker could potentially abuse these bugs to learn information about a server’s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.

The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation. In addition, an internal review resulted in other improvements to prevent rare failures in ECDH and ECDSA when using the NUMS curves.

Exploitability Assessment

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

Publicly Disclosed Exploited Latest Software Release Older Software Release Denial of Service No No 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable
Affected Products

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.

Product Platform Article Download Impact Severity Supersedence Microsoft Research JavaScript Cryptography Library V1.4 Release Details Security Update Security Feature Bypass Important
Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

FAQ

The vulnerable version of the MSR Crypto JavaScript Security library is 1.4. The version with the security update is 1.4.1.
There are two possible steps required:

Install the 1.4.1 update.

If you are using the NIST P-521 curve, revoke and replace X.509 certificates issued using the NIST P-521 curve, and invalidate data signed by such certificates.

Acknowledgements

Jonathan Burns of Ionic Security Colin McRae of Ionic Security Ryan Speers of Ionic Security

See acknowledgements for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

Version Date Description 1.0 07/10/2018 Information published. 1.1 07/11/2018 Added an FAQ regarding the availability of the update. 2.0 07/16/2018 Information updated to announce the release of MSR JavaScript Cryptography Library version 1.4.1.
Click to expand...

Source: https://portal.msrc.microsoft.com/en.../CVE-2018-8319

:)

Brink · Jul 16, 2018

Intel Integrated Performance Primitives Cryptography Library Update

Intel ID: INTEL-SA-00106 Product family: Intel® Integrated Performance Primitives Impact of vulnerability: Information Disclosure Severity rating: Moderate Original release: 05/10/2018 Last revised: 05/10/2018
Summary:
Some implementations in Intel® Integrated Performance Primitives Cryptography Library before version 2018 U2.1 do not properly ensure constant execution time.
- 4.7 Medium CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products:
Intel® Integrated Performance Primitives Cryptography Library before 2018 U2.1.

Recommendations:
Intel recommends that users of Intel® Integrated Performance Primitives Cryptography Library evaluate their implementations and update to IPP 2018 U2.1 as appropriate.

For the latest release: https://registrationcenter.intel.com...productid=2717

Acknowledgements:
Intel thanks Ahmad Moghimi, Thomas Eisenbarth, and Berk Sunar from Worcester Polytechnic Institute for reporting this issue.

Revision History

Revision Date Description 1.0 May 10, 2018 Initial Release
Click to expand...

Source: INTEL-SA-00106

Yukikaze · Jul 16, 2018

WPA2 Vulnerability Found

A small update with regards to the Microsoft fix. The fix itself is sufficient to solve the issue on Windows, even if your WiFi device has no driver update, with one caveat:

Does this security update fully address these vulnerabilities on Microsoft Platforms, or do I need to perform any additional steps to be fully protected?
The provided security updates address the reported vulnerabilities; however, when affected Windows based systems enter a connected standby mode in low power situations, the vulnerable functionality may be offloaded to installed Wi-Fi hardware. To fully address potential vulnerabilities, you are also encouraged to contact your Wi-Fi hardware vendor to obtain updated device drivers. For a listing of affected vendors with links to their documentation, review the ICASI Multi-Vendor Vulnerability Disclosure statement here: http://www.icasi.org/wi-fi-protected-access-wpa-vulnerabilities

Source: {{windowTitle}}

GregSorg · Jul 16, 2018

Security Vulnerability

Is Win XP installed as a Virtual Machine in Win 10 a security vulnerability?

Windows 10: MSR JavaScript Cryptography Library Security Vulnerability

MSR JavaScript Cryptography Library Security Vulnerability

MSR JavaScript Cryptography Library Security Vulnerability

MSR JavaScript Cryptography Library Security Vulnerability

MSR JavaScript Cryptography Library Security Vulnerability - Similar Threads - MSR JavaScript Cryptography

security vulnerabilities in shared files/directories?

Finding security vulnerability in windows 8.1

Finding security vulnerability in windows 8.1

Windows 10 login security vulnerability

Cryptography Windows 10?

New Vulnerability in the Microsoft Cryptographic Library

VLC Security Vulnerability

Potential security vulnerabilities in Intel firmware

Intel Integrated Performance Primitives Cryptography Library Update

Users found this page by searching for:

msr javascript cryptography library