The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers’ installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2077
Reference (s):
- BID:72693
- URL: http://www.securityfocus.com/bid/72693
- CERT:TA15-051A
- URL: http://www.us-cert.gov/cas/techalerts/TA15-051A.html
- CERT-VN:VU#529496