Skip to main content

SSL certificate validation flaw discovered in Kaspersky AV software

posted onJanuary 5, 2017
by l33tdawg

Tavis Ormandy continues his war on buggy antivirus software, as the Google Project Zero researcher reported two serious vulnerabilities, including an SSL certificate validation flaw, in Kaspersky Lab's popular antivirus offering.

Ormandy reported the vulnerabilities to the vendor in November, and Kaspersky released fixes for both on Dec. 28, though publication of the flaws was "slightly delayed due to the holidays," according to the issue reports.

The more serious of the two vulnerabilities, which is rated critical by Project Zero, involves an SSL certificate validation bug that allows an attacker to easily execute man-in-the-middle attacks by brute-forcing a collision between a valid certificate and a malicious certificate.

Source

Tags

Industry News

You May Also Like

Recent News

Friday, November 29th

Tuesday, November 19th

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th

Simplenews subscription

Stay informed - subscribe to our newsletter.
The subscriber's email address.
Keeping Knowledge Free for Over a Decade

Copyright © 2018 Hack In The Box. All rights reserved.

36th Floor, Menara Maxis, Kuala Lumpur City Centre 50088 Kuala Lumpur Malaysia
Tel: +603-2615-7299 Fax: +603-2615-0088