Overview
Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver package silently install a root CA certificate into the Windows trusted root certificate store.
Description
Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver package silently install a SaviAudio root CA certificate into the Windows trusted root certificate store. According to Savitech, this certificate is used for driver signing under Windows XP and is no longer necessary, but was not removed from installers for later operating systems. This issue has been assigned CVE-2017-9758. There is currently no evidence that the Savitech private key is compromised. However, users are encouraged to remove the certificate out of caution. The two known certificates are: |
Impact
An attacker with access to the Savitech private key material may be able to impersonate web sites and other services, sign and install malicious software, and decrypt network traffic and other data (man in the middle) on affected systems. |
Solution
Remove Savitech certificate |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 8.8 | AV:N/AC:M/Au:N/C:C/I:C/A:N |
| Temporal | 6.9 | E:POC/RL:OF/RC:C |
| Environmental | 5.2 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
References
- https://community.rsa.com/community/products/netwitness/blog/2017/10/27/inaudible-subversion-did-your-hi-fi-just-subvert-your-pc
- https://technet.microsoft.com/en-us/library/dn265983.aspx
- https://technet.microsoft.com/en-us/library/cc772354.aspx
- http://windows.microsoft.com/en-us/windows-vista/view-or-manage-your-certificates
- https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
- https://technet.microsoft.com/en-us/library/security/3119884.aspx
- http://huagati.blogspot.com/2015/07/do-you-know-which-cas-can-issue-ssltls.html
Acknowledgements
Thanks to Kent Backman from RSA for reporting this vulnerability.
This document was written by Garret Wassermann.
Other Information
| CVE IDs: | CVE-2017-9758 |
| Date Public: | 2017-10-03 |
| Date First Published: | 2017-11-02 |
| Date Last Updated: | 2017-11-06 16:00 UTC |
| Document Revision: | 47 |