{"vuid":"VU#446847","idnumber":"446847","name":"Savitech USB audio drivers install a new root CA certificate","keywords":["ca","certificate","crypto","signing","driver"],"overview":"Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver package silently install a root CA certificate into the Windows trusted root certificate store.","clean_desc":"Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver package silently install a SaviAudio root CA certificate into the Windows trusted root certificate store. According to Savitech, this certificate is used for driver signing under Windows XP and is no longer necessary, but was not removed from installers for later operating systems. This issue has been assigned CVE-2017-9758. There is currently no evidence that the Savitech private key is compromised. However, users are encouraged to remove the certificate out of caution. The two known certificates are: SaviAudio root certificate #1\n‎Validity: Thursday, ‎May ‎31, ‎2012 - ‎Tuesday, ‎December ‎30, ‎2036\nSerial number: 579885da6f791eb24de819bb2c0eeff0\nThumbprint:  cb34ebad73791c1399cb62bda51c91072ac5b050 SaviAudio root certificate #2\nValidity: ‎Thursday, ‎December ‎31, ‎2015 - ‎Tuesday, ‎December ‎30, ‎2036\nSerial number: ‎972ed9bce72451bb4bd78bfc0d8b343c\nThumbprint: 23e50cd42214d6252d65052c2a1a591173daace5 Savitech has released a new driver package to address the issue. Savitech drivers version 2.8.0.3 or later do not install the root CA certificate. Users still must remove any previously installed certificate manually. The researchers have released a blog post with further details and impacts of this issue.","impact":"An attacker with access to the Savitech private key material may be able to impersonate web sites and other services, sign and install malicious software, and decrypt network traffic and other data (man in the middle) on affected systems.","resolution":"Remove Savitech certificate Users who have installed these drivers are encouraged to remove the SaviAudio root CA certificate from Savitech. Microsoft provides guidance on deleting and managing certificates in the Windows certificate store; users will need to search for certificate management for their specific Windows environment. Apply an update After removal, users are encouraged to install the latest Savitech driver package, version 2.8.0.3 or later.","workarounds":"","sysaffected":"","thanks":"Thanks to Kent Backman from RSA for reporting this vulnerability.","author":"This document was written by Garret Wassermann.","public":["https://community.rsa.com/community/products/netwitness/blog/2017/10/27/inaudible-subversion-did-your-hi-fi-just-subvert-your-pc","https://technet.microsoft.com/en-us/library/dn265983.aspx","https://technet.microsoft.com/en-us/library/cc772354.aspx","http://windows.microsoft.com/en-us/windows-vista/view-or-manage-your-certificates","https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html","https://technet.microsoft.com/en-us/library/security/3119884.aspx","http://huagati.blogspot.com/2015/07/do-you-know-which-cas-can-issue-ssltls.html"],"cveids":["CVE-2017-9758"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2017-08-09T15:04:19Z","publicdate":"2017-10-03T00:00:00Z","datefirstpublished":"2017-11-02T19:48:25Z","dateupdated":"2017-11-06T16:00:40Z","revision":47,"vrda_d1_directreport":"1","vrda_d1_population":"2","vrda_d1_impact":"2","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"M","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"8.8","cvss_basevector":"AV:N/AC:M/Au:N/C:C/I:C/A:N","cvss_temporalscore":"6.9","cvss_environmentalscore":"5.1515633023344","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}