Information disclosure in Komodia Redirector Sdk
CVE-2015-2077
The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.
Vulnerability class: Information Disclosure
EPSS: 0.028 (84.9th percentile) — read the EPSS interpretation.
Affected products
- Komodia Redirector_sdk
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_CERT, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2015-2077?
- CVE-2015-2077 is a vulnerability in Komodia Redirector Sdk, classified under Information Disclosure. Published 2015-02-24.
- Is CVE-2015-2077 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.