NVD

Id
24244  
Name
CVE-2015-2077  
Description
The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers" installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-02-24  
Modified Date
2016-12-30  
Seq
2015-2077  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
128393 24244 CVE-2015-2077 http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4  View
128394 24244 CVE-2015-2077 http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4  View
128395 24244 CVE-2015-2077 http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/  View
128396 24244 CVE-2015-2077 http://news.lenovo.com/article_display.cfm?article_id=1929  View
128397 24244 CVE-2015-2077 http://support.lenovo.com/us/en/product_security/superfish  View
128398 24244 CVE-2015-2077 VU#529496  View
128399 24244 CVE-2015-2077 72693  View
128400 24244 CVE-2015-2077 1031779  View
128401 24244 CVE-2015-2077 http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish  View
128402 24244 CVE-2015-2077 TA15-051A  View
128403 24244 CVE-2015-2077 http://www.wired.com/2015/02/lenovo-superfish/  View
128404 24244 CVE-2015-2077 https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/  View
128405 24244 CVE-2015-2077 https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6295 JVNDB-2015-001615 複数の製品で使用される Komodia Redirector SDK の SSL Digestor における SSL サーバになりすまされる脆弱性 Lavasoft Ad-Aware Web Companion、Ad-Aware AdBlocker (alpha)、Windows 用 Qustodio、Atom Security, Inc. StaffCop、およびその他の製品で使用される Komodia Redirector SDK の SSL Digestor は、異なるカスタマのインストールのルート CA 証明書に、同一の X.509 証明書秘密鍵を使用するため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2015-2077 79302 CVE-2015-2077 24244 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001615.html 2015-02-19 2015-02-26 View