CVE-2013-3900 : The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Ser

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."

Published 2013-12-11 00:55:04

Updated 2022-11-02 15:15:44

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Input validationExecute code

CVE-2013-3900 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Microsoft WinVerifyTrust function Remote Code Execution

CISA required action:

Apply updates per vendor instructions.

CISA description:

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

Added on 2022-01-10 Action due date 2022-07-10

Exploit prediction scoring system (EPSS) score for CVE-2013-3900

Probability of exploitation activity in the next 30 days: 43.69%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2013-3900

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.6	HIGH	AV:N/AC:H/Au:N/C:C/I:C/A:C	4.9	10.0	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2013-3900

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-3900

http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode.aspx

MS13-098: Update to enhance the security of Authenticode – Microsoft Security Response Center
Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-098

Microsoft Security Bulletin MS13-098 - Critical | Microsoft Docs
Patch;Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900

CVE-2013-3900 - Security Update Guide - Microsoft - WinVerifyTrust Signature Validation Vulnerability
Patch;Vendor Advisory

Products affected by CVE-2013-3900