EnableCertPaddingCheck

Question

Hi All

i have the CVE-2013-3900 vulnerability(WinVerifyTrust Signature Validation Vulnerability). i need to add the below registry values to fix it.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config] "EnableCertPaddingCheck"="1"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config] "EnableCertPaddingCheck"="1"

Answer 1

Hi @Glenn Maxwell

Try this script, it works on my machine:

$registryPath = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Conf"

$Name = "EnableCertPaddingCheck"

$value = "1"

IF(!(Test-Path $registryPath))

    {

    New-Item -Path $registryPath -Force | Out-Null

    New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType String -Force | Out-Null
    }

 ELSE 
    {

    New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType String -Force | Out-Null
    }

Please d'on't forget to mark helpful answer

Answer 2

I believe the RegistryPath is wrong.

$registryPath = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Conf"

This should be:

$registryPath = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config"

See: https://www.tenable.com/plugins/nessus/166555

Answer 3

Hi @Glenn Maxwell

You can use Powershell to create the Path if it's not exist before the registry key . Below a example :

$registryPath = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Conf"

$Name = "EnableCertPaddingCheck"

$value = "1"

IF(!(Test-Path $registryPath))

  {

    New-Item -Path $registryPath -Force | Out-Null

    New-ItemProperty -Path $registryPath -Name $name -Value $value `

    -PropertyType DWORD -Force | Out-Null}

 ELSE {

    New-ItemProperty -Path $registryPath -Name $name -Value $value `

    -PropertyType String -Force | Out-Null}
$registryPath = "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Conf"

$Name = "EnableCertPaddingCheck"

$value = "1"

IF(!(Test-Path $registryPath))

    {

    New-Item -Path $registryPath -Force | Out-Null

    New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType String -Force | Out-Null
    }

 ELSE 
    {

    New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType String -Force | Out-Null
    }

The links below may help you:

New-ItemProperty

Update or Add Registry Key Value with PowerShell

Please don't forget to mark helpful answer as accepted