Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Microsoft Security Advisory Adv180029 for Sennheiser software
#1
Information 
[Image: sennheiser-windows-advisory.png]
Quote:Microsoft published a security advisory today under ADV180029  -- Inadvertently Disclosed Digital Certificates Could Allow Spoofing -- that warns users and administrators about two Sennheiser software programs that may have introduced vulnerabilities on Windows devices they were installed on.

The two Sennheiser products HeadSetup and HeadSetup Pro installed root certificates on systems they were installed on. Users, who had to run the installer with elevated privileges because of that, were not informed about that.

Older versions of the application placed the private key and the certificate in the installation folder which in itself is not a good practice. Sennheiser used the same private key for all software installations of Sennheiser HeadSetup 7.3 or older.

Anyone, who installed the software on a computer system or got hold of the private key, could potentially abuse it because of that. An attacker could issue certificates on the system the software is installed on.

The certificate is self-signed, marked as a CA certificate and valid until January 13, 2027 when installed. The installer "pushes the certificate into the local machine trusted root certificate store of the Windows system on which it is installed".
Full reading: https://www.ghacks.net/2018/11/28/micros...-software/
[-] The following 1 user says Thank You to harlan4096 for this post:
  • silversurfer
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
AWZ Screen Recorder
AWZ Screen Recorder ...zevish — 11:05
Website X5 Go 2024.1
Website X5 Go 2024.1...zevish — 09:32
Apple's rules to allow third-party app ...
Apple has announ...alison30 — 09:28
Intel: Microsoft AI PCs need a Copilot K...
Microsoft hopes th...harlan4096 — 08:55
Synchredible 8 Professional Edition v8.2...
          Synchredib...zevish — 08:54

[-]
Birthdays
Today's Birthdays
No birthdays today.
Upcoming Birthdays
No upcoming birthdays.

[-]
Online Staff
There are no staff members currently online.

>