PT-2015-5589 · Lavasoft+3 · Ad-Aware Adblocker+4
Chris Palmer
+4
·
Publicado
2015-02-24
·
Atualizado
2015-02-28
·
CVE-2015-2078
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Komodia Redirector with SSL Digestor (affected versions not specified)
Lavasoft Ad-Aware Web Companion version 1.1.885.1766
Lavasoft Ad-Aware AdBlocker (alpha) version 1.3.69.1
Qustodio for Windows (affected versions not specified)
Atom Security, Inc. StaffCop version 5.8
Description
The issue concerns the SDK for Komodia Redirector with SSL Digestor, which is used in various products. It does not properly verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers.
Recommendations
For Lavasoft Ad-Aware Web Companion version 1.1.885.1766, update the SSL verification mechanism to properly validate X.509 certificates.
For Lavasoft Ad-Aware AdBlocker (alpha) version 1.3.69.1, consider disabling SSL connections until a proper certificate verification mechanism is implemented.
For Qustodio for Windows, restrict access to sensitive information until the SSL verification issue is resolved.
For Atom Security, Inc. StaffCop version 5.8, disable the use of SSL Digestor until a patch is available that properly verifies X.509 certificates.
At the moment, there is no information about a newer version that contains a fix for this vulnerability in Komodia Redirector with SSL Digestor.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ad-Aware Adblocker
Ad-Aware Web Companion
Komodia Redirector With Ssl Digestor
Qustodio For Windows
Staffcop