Lenovo Superfish Adware HTTPS Spoofing Vulnerability
Last Update Date:
23 Feb 2015 11:12
Release Date:
23 Feb 2015
3298
Views
RISK: Medium Risk
TYPE: Clients - Browsers
Superfish adware installed on some Lenovo PCs install a non-unique trusted root certification authority (CA) certificate, allowing an attacker to spoof HTTPS traffic.
A machine with Superfish VisualDiscovery installed will be vulnerable to SSL spoofing attacks without a warning from the browser.
Impact
- Information Disclosure
- Spoofing
System / Technologies affected
Superfish may have appeared on these models:
- G Series: G410, G510, G710, G40-70, G50-70, G40-30, G50-30, G40-45, G50-45, G40-80
- U Series: U330P, U430P, U330Touch, U430Touch, U530Touch
- Y Series: Y430P, Y40-70, Y50-70, Y40-80, Y70-70
- Z Series: Z40-75, Z50-75, Z40-70, Z50-70, Z70-80
- S Series: S310, S410, S40-70, S415, S415Touch, S435, S20-30, S20-30Touch
- Flex Series: Flex2 14D, Flex2 15D, Flex2 14, Flex2 15, Flex2 Pro, Flex 10
- MIIX Series: MIIX2-8, MIIX2-10, MIIX2-11, MIIX 3 1030
- YOGA Series: YOGA2Pro-13, YOGA2-13, YOGA2-11, YOGA3 Pro
- E Series: E10-30
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Remove the Superfish Application and Certificate
http://support.lenovo.com/us/en/product_security/superfish_uninstall
Vulnerability Identifier
- No CVE information is available
Source
Related Link
Share with