Vulnerability Note VU#260780
NetNanny uses a shared private key and root CA
NetNanny uses a shared private key and root Certificate Authority (CA), making systems broadly vulnerable to HTTPS spoofing.
NetNanny installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all installations of NetNanny. Furthermore, the private key used to generate the certificate is also shared and may be obtained in plaintext directly from the software. An attacker may use this shared private key to generate new certificates that would be signed by and therefore trusted by NetNanny. An affected user would not be alerted to a false malicious HTTPS website as NetNanny would trust the spoofed certificate. NetNanny has provided more information on this issue on their FAQ.
We have confirmed that NetNanny version 18.104.22.168 is affected. Other versions may also be affected.
An attacker can spoof HTTPS sites and intercept HTTPS traffic without triggering browser certificate warnings in affected systems.
Disable SSL filtering and remove the certificate
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Content Watch||Affected||27 Mar 2015||05 May 2015|
CVSS Metrics (Learn More)
Thanks to Imran Ghory for reporting this issue to us.
This document was written by Garret Wassermann.
- CVE IDs: Unknown
- Date Public: 20 Apr 2015
- Date First Published: 20 Apr 2015
- Date Last Updated: 07 May 2015
- Document Revision: 45
If you have feedback, comments, or additional information about this vulnerability, please send us email.