CVE

Id
79354  
CVE No.
CVE-2015-2077  
Status
Candidate  
Description
The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers" installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.  
Phase
Assigned (20150224)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
721591 79354 CVE-2015-2077 MISC:http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4  View
721592 79354 CVE-2015-2077 MISC:http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4  View
721593 79354 CVE-2015-2077 MISC:http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/  View
721594 79354 CVE-2015-2077 MISC:http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish  View
721595 79354 CVE-2015-2077 MISC:http://www.wired.com/2015/02/lenovo-superfish/  View
721596 79354 CVE-2015-2077 MISC:https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/  View
721597 79354 CVE-2015-2077 MISC:https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339  View
721598 79354 CVE-2015-2077 CONFIRM:http://news.lenovo.com/article_display.cfm?article_id=1929  View
721599 79354 CVE-2015-2077 CONFIRM:http://support.lenovo.com/us/en/product_security/superfish  View
721600 79354 CVE-2015-2077 CERT:TA15-051A  View
721601 79354 CVE-2015-2077 URL:http://www.us-cert.gov/cas/techalerts/TA15-051A.html  View
721602 79354 CVE-2015-2077 CERT-VN:VU#529496  View
721603 79354 CVE-2015-2077 URL:http://www.kb.cert.org/vuls/id/529496  View
721604 79354 CVE-2015-2077 BID:72693  View
721605 79354 CVE-2015-2077 URL:http://www.securityfocus.com/bid/72693  View
721606 79354 CVE-2015-2077 SECTRACK:1031779  View

Related JVN