CVE-2013-3900 WinVerifyTrust Signature Validation Vulnerability

Roger Roger 4,951 Reputation points
2023-02-20T20:35:49.2333333+00:00

Hi All

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900

To remediate the vulnerability CVE-2013-3900 is to add the below registry values.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

  1. On Windows servers 2016/2019 i dont see the folders Wintrust\Config in registries. do i need to create these folders and the registry value EnableCertPaddingCheck"=1.
  2. using powershell script i have created Wintrust & config folder and added EnableCertPaddingCheck"="1" , Is Reg_SZ type correct?
    1. {Default}-Reg_SZ also got created, will this create any issue.

reg

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,470 questions
Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,379 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,171 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,729 questions
Accepted answer
  1. Dave Patrick 426.1K Reputation points MVP
    2023-02-20T20:50:08.7933333+00:00

    Using the REG file examples a REG_SZ will be created by default so yes it would be correct.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    7 people found this answer helpful.
    0 comments

6 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fernando Palerosi Carneiro 0 Reputation points
    2023-12-01T09:54:28.52+00:00

    No problem with registry type DWORD.

    REG ADD “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Wintrust\Config” /v EnableCertPaddingCheck /t REG_DWORD /d 1

    REG ADD “HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config” /v EnableCertPaddingCheck /t REG_DWORD /d 1

    0 comments
  2. Rafid PBICL 0 Reputation points
    2024-05-02T06:25:22.17+00:00

    According to this article: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-098

    Windows server 2016, 2019 and 2022 are not in the list of affected products.

    So, I still need to apply remediation steps on windows server 2016, 2019 and 2022 for CVE-2013-3900 vulnerability ?

    Waiting for your prompt response

    0 comments