EnableCertPaddingCheck

Richard Realejo 1

Hello,
The WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation (EnableCertPaddingCheck) recently started appearing on my Windows 10 machines.
I've read that the solution is to add the following to the registry
[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

My question is, will this create a REG_SZ string value or a DWORD value, and which one should it be?

TIA

Robert Ben Jordan 0 Reputation points

2024-06-18T19:38:00.47+00:00
When you add the entries to the registry as mentioned:

They should be created as REG_SZ (string) values, not as DWORD values.

You'll need to create a new string value named "EnableCertPaddingCheck" under the specified registry paths.

Set the value of "EnableCertPaddingCheck" to "1" (without quotes).

After making these changes, restart your computer for the changes to take effect.

This approach should help mitigate the WinVerifyTrust Signature Validation CVE-2013-3900 issue on your Windows 10 machines. If you have any more questions or need further assistance, feel free to ask at consejosandroid or mynsfaslogins
Malina Diego 0 Reputation points

2024-10-02T21:24:12.58+00:00

Al agregar las entradas al registro como se menciona:

Deben crearse como valores REG_SZ (cadena), no como valores DWORD. Necesitarás crear un nuevo valor de cadena llamado "EnableCertPaddingCheck" en las rutas de registro especificadas. Establece el valor de "EnableCertPaddingCheck" en "1" (sin comillas). Después de hacer estos cambios, reinicia tu computadora para que surtan efecto.

Este enfoque debería ayudar a mitigar el problema de validación de la firma WinVerifyTrust CVE-2013-3900 en tus máquinas con Windows 10. Si tienes más preguntas o necesitas más asistencia, no dudes en preguntar.

Para más información, visita consejosandroid.

6 answers

jandec 11 Reputation points

2022-11-08T06:48:02.443+00:00

Hi,
When following the instructions and creating the .reg files as published in https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2013-3900, the registry keys are created as REG_SZ.

HTH
Please sign in to rate this answer.

2 people found this answer helpful.
Areiza, Juan C. (NSSC-NCCIPS)[SAIC] 10 Reputation points

2023-05-05T19:41:08.37+00:00

thank you
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Areiza, Juan C. (NSSC-NCCIPS)[SAIC] 10 Reputation points

2023-04-18T19:08:16.5833333+00:00

trying making sure the 1 is a DWORD and not REG_SZ
Please sign in to rate this answer.

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Matt D. Sardi 35 Reputation points

2023-03-24T12:41:41.0933333+00:00

These registry keys will not remediate this issue. I have another request open for Microsoft to provided an updated and correct solution.
Please sign in to rate this answer.

1 person found this answer helpful.
ChopperDude 6 11 Reputation points

2023-05-04T13:42:06.7366667+00:00

I too have the same issue that the registry values do not remediate the issue. Please post the fix; IF MS actually provides you with an answer.

skatterbrainz 31 Reputation points

2023-05-05T18:53:18+00:00

Have you confirmed this? Any update from your request to Microsoft?

Romulo Brasil 1 Reputation point

2023-05-31T14:06:46.9533333+00:00

Hi Matt, why are you affirming this? Can you share more information with us?

IVAN TORRES 41 Reputation points

2023-07-25T21:16:52.4466667+00:00

You are right @Matt could you please share the solution, thanks

Rajkumar Swaminathan 0 Reputation points

2023-09-07T04:57:21.7033333+00:00

Hi, can you provide the solution?

ChopperDude 6 11 Reputation points

2023-09-07T05:10:24.8166667+00:00

This worked for me. add the following entries to the registry:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Machado, Claudemar (contracted) 0 Reputation points

2023-01-17T19:16:51.5733333+00:00

Hi, once I have created as REG_SZ, should I use content number 1 or the word "enable". ?
Please sign in to rate this answer.
Matt D. Sardi 35 Reputation points

2023-03-24T13:03:09.4766667+00:00

All documentation for this CVE says to set the value to either zero which represents false or 1 which represents true.

False = disabled

True = enabled

However, these reg keys do not remediate this vuln. I am still waiting on a proper fix to remediate microsoft's vulnerability.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Walsh, Liam 36 Reputation points

2023-05-31T10:49:25.41+00:00

What is the impact of this change? (apart from satisfying a vulernability scanner)
Please sign in to rate this answer.
Jared DeWitt 0 Reputation points

2023-08-23T19:30:23.81+00:00

There could be an impact if you're using AppLocker or Software Restriction policies. But it really comes down to the signature on the file you're using. If the developer/vendor isn't using best practices, the file could possibly fail the stricter verification requirements. But I would push back on those vendors or developers to fix their file signatures.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

EnableCertPaddingCheck

6 answers

Your answer