Script_CVE-2013-3900_fix

Overview

This executable enables stricter Authenticode signature padding validation by configuring the WinVerifyTrust EnableCertPaddingCheck registry value.

CVE-2013-3900

Executable: Script_CVE-2013-3900_fix.exe

Solution

1. Access the Device

• Log in to the Windows device where the mitigation needs to be applied.

• Ensure that you have the required Administrator privileges.

2. Configure the Registry Setting

The executable configures the following registry value:

• Registry key: HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config

• Value: EnableCertPaddingCheck

• Data type: REG_DWORD

• Data: 1

3. Configure the Registry Views

The executable handles the Windows registry views as follows:

• On 64-bit Windows, it writes the 64-bit registry view.

• It then writes the 32-bit registry view.

This ensures that the EnableCertPaddingCheck setting is configured in both applicable registry views.

4. Apply the Configuration

The executable runs silently and writes EnableCertPaddingCheck=1 so Windows performs the additional certificate-padding validation associated with the CVE-2013-3900 hardening guidance.

The resulting configuration is:

HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config 
EnableCertPaddingCheck    REG_DWORD    1

5. Verify the Configuration

Verify that the following registry value is present on the target device:

• Registry key: HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config

• Value: EnableCertPaddingCheck

• Type: REG_DWORD

• Data: 1

On 64-bit Windows, verify that the setting is written to both the 64-bit and 32-bit registry views.

References

Microsoft MS13-098: WinVerifyTrust signature validation update:
https://support.microsoft.com/en-us/servicing/os/windows/2013/12/ms13-098-vulnerability-in-windows-could-allow-remote-code-execution-december-10-2013

Microsoft Security Update Guide: CVE-2013-3900:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900