Custom Query (16611 matches)

An application called DisplayFusion changed code signing certificates with a new signature algorithm and now the hooks are being blocked by VirtualBox. This line was in the VBoxHardening.log file:

a194.9484:
supR3HardenedScreenImage/LdrLoadDll:
rc=-23005 fImage=1 fProtect=0x0 fAccess=0x0
\Device\HarddiskVolume5\Program Files\DisplayFusion\Hooks\AppHook64_59f4d7ea-304b-458e-9fb9-c946ed7360a5.dll:
Certificate signature algorithm not known: 1.2.840.10045.4.3.3:
\Device\HarddiskVolume5\Program Files\DisplayFusion\Hooks\AppHook64_59f4d7ea-304b-458e-9fb9-c946ed7360a5.dll

Looking in the code in the function RTCrX509Certificate_VerifySignature it calls RTCrPkixGetCiperOidFromSignatureAlgorithm then returns this error.

I think the list of OIDs needs to be updated in RTCrPkixGetCiperOidFromSignatureAlgorithm, right now it only has RTCR_PKCS1_OID which is defined as 1.2.840.113549.1.1. According to this document that means only *WithRsaEncryption are valid signature algorithms. I think ecdsaWith* 1.2.840.10045.4.* OIDs need to be allowed now as well to update this check.

​https://www.ibm.com/docs/en/zos/2.1.0?topic=programming-object-identifiers

I'm happy to provide more information or even the code required to fix this issue if that helps. Thanks!

With the 6.1.14 and 6.1.16 releases, "Check for Updates" on OSX has not found any updates. 6.1.16 was released 6 days ago and when I ran 6.1.14 just now and check, it says "You are on the latest version". I obviously can't check 6.1.16 has the same issues, but the last 2 releases have, so I guess this will too.

I cannot do "Check for Updates" (under the Help menu, Windows version) because VirtualBox doesn't honor the OS proxy server setting, and doesn't offer a place to enter my proxy info manually into VirtualBox.