This week we patched two vulnerabilities affecting Windows CryptoAPI DLLs which could lead remote code execution if exploited via crafted messages sent over DDE links.

We received initial disclosure about these vulnerabilities from Google Project Zero via coordinated disclosure approximately four months ago.

In this post I will cover how we approached patching these vulnerabilities.

Note that we published additional details regarding this vulnerability series after our public disclosure last week:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/MS18-060

Vulnerability Background And Analysis Process

Last fall we saw another vulnerability series which impacted Windows CryptoAPI DLLs.
In that case we issued patches against six distinct vulnerabilities.
In both cases we found multiple vulnerabilities within Windows CryptoAPI DLLs which could be exploited via crafted messages sent over DDE links.
As I mentioned above we disclosed these vulnerabilities publicly last week.
Here is our blog post regarding last year’s vulnerability series:
https://www.microsoft.com/en-us/security/blog/2017/10/10/cryptographic-flaw-discovered-in-windows-cryptoapi-dlls/

We received initial disclosure from Google Project Zero via coordinated disclosure