Vulnerability Note VU#366544
Adtrustmedia PrivDog fails to validate SSL certificates
Adtrustmedia PrivDog fails to validate SSL certificates, making systems broadly vulnerable to HTTPS spoofing.
Adtrustmedia PrivDog is a Windows application that advertises "... safer, faster and more private web browsing." Privdog installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The MITM capabilities are provided by NetFilterSDK.com. Although the root CA certificate is generated at install time, resulting in a different certificate for each installation, Privdog does not use the SSL certificate validation capabilities that the NetFilter SDK provides. This means that web browsers will not display any warnings when a spoofed or MITM-proxied HTTPS website is visited. We have confirmed that PrivDog version 220.127.116.11 is affected.
Adtrustmedia PrivDog is promoted by the Comodo Group, which is an organization that offers SSL certificates and authentication solutions.
An attacker can spoof HTTPS sites and intercept HTTPS traffic without triggering browser certificate warnings in affected systems.
Apply an update
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|AdTrustMedia||Affected||-||23 Feb 2015|
|COMODO Security Solutions, Inc.||Not Affected||23 Feb 2015||26 Feb 2015|
|NetFilterSDK.com||Unknown||-||23 Feb 2015|
CVSS Metrics (Learn More)
This vulnerability was publicly reported by Hanno Böck.
This document was written by Will Dormann.
- CVE IDs: Unknown
- Date Public: 22 Feb 2015
- Date First Published: 23 Feb 2015
- Date Last Updated: 26 Feb 2015
- Document Revision: 70
If you have feedback, comments, or additional information about this vulnerability, please send us email.