5

CVE-2015-2077

Exploit
The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Komodia ≫ Redirector Sdk Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.78% 0.845
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4
Exploit
http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4
http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/
http://news.lenovo.com/article_display.cfm?article_id=1929
http://support.lenovo.com/us/en/product_security/superfish
http://www.kb.cert.org/vuls/id/529496
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/72693
http://www.securitytracker.com/id/1031779
http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish
http://www.us-cert.gov/cas/techalerts/TA15-051A.html
Third Party Advisory
US Government Resource
http://www.wired.com/2015/02/lenovo-superfish/
https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/
Exploit
https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339