QID 45526

This Information Gathering QID is based on the republished information for the WinVerifyTrust Signature Validation Vulnerability from Microsoft.

Microsoft stated that, they have re-published this to inform customers that EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. And Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft windows.

This behavior remains available as an opt-in feature via registry key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The registry key already exists in Window 10 and Window 11, so no security update is required but the reg key must be set.

QID Detection Logic (Authenticated):
This QID checks for the presence of these registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config and HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config, and checks whether the value 'EnableCertPaddingCheck' associated with these keys is set to 1.
If these keys are missing or the value is not set to 1, then this QID gets reported.

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature.