Lavasoft · Ad-Aware Adblocker · CVE-2015-2078
**Name of the Vulnerable Software and Affected Versions**
Komodia Redirector with SSL Digestor (affected versions not specified)
Lavasoft Ad-Aware Web Companion version 1.1.885.1766
Lavasoft Ad-Aware AdBlocker (alpha) version 1.3.69.1
Qustodio for Windows (affected versions not specified)
Atom Security, Inc. StaffCop version 5.8
**Description**
The issue concerns the SDK for Komodia Redirector with SSL Digestor, which is used in various products. It does not properly verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers.
**Recommendations**
For Lavasoft Ad-Aware Web Companion version 1.1.885.1766, update the SSL verification mechanism to properly validate X.509 certificates.
For Lavasoft Ad-Aware AdBlocker (alpha) version 1.3.69.1, consider disabling SSL connections until a proper certificate verification mechanism is implemented.
For Qustodio for Windows, restrict access to sensitive information until the SSL verification issue is resolved.
For Atom Security, Inc. StaffCop version 5.8, disable the use of SSL Digestor until a patch is available that properly verifies X.509 certificates.
At the moment, there is no information about a newer version that contains a fix for this vulnerability in Komodia Redirector with SSL Digestor.