Microsoft published a security advisory today under ADV180029 -- Inadvertently Disclosed Digital Certificates Could Allow Spoofing -- that warns users and administrators about two Sennheiser software programs that may have introduced vulnerabilities on Windows devices they were installed on.
The two Sennheiser products HeadSetup and HeadSetup Pro installed root certificates on systems they were installed on. Users, who had to run the installer with elevated privileges because of that, were not informed about that.
Older versions of the application placed the private key and the certificate in the installation folder which in itself is not a good practice. Sennheiser used the same private key for all software installations of Sennheiser HeadSetup 7.3 or older.
Anyone, who installed the software on a computer system or got hold of the private key, could potentially abuse it because of that. An attacker could issue certificates on the system the software is installed on.
The certificate is self-signed, marked as a CA certificate and valid until January 13, 2027 when installed. The installer "pushes the certificate into the local machine trusted root certificate store of the Windows system on which it is installed".
Updates of the application or removal of the HeadSetup software on a system version 7.3 or earlier were installed on won't remove the certificate. Systems the software was installed on at a point in time remain vulnerable therefore even if the software is no longer installed on these systems.
German security company Secorvo Security Consulting GMHB published a vulnerability report that provides additional details.
Secorvo describes several attack scenarios in the report:
Sennheiser changed the installation system in newer versions of Sennheiser HeadSetup. Attackers can't create valid certificates anymore directly as Sennheiser kept these secret this time.
The researchers could not find any published information about the "policies according to which the SeenComRootCA operates" and consider the "risk that an attacker might fraudulently obtain a certificate significantly higher [..] than for other pre-installed Root CAs or their respective Sub CAs".
Sennheiser has not published an update at the time of writing that resolves the issue but removed downloads of existing setup versions of the application. Microsoft, however, removed the certificates from its Certificate Trust List.
You can track the issue under CVE-2018-17612.
Administrators may remove the certificates in the following way:
Note: if you need the web-based functionality, remove only the first certificate and wait for an update of the software application.
Active Directory administrators may place the certificates into the Untrusted Certificates store; this is found under Policies\Windows Settings\Security Settings\Public Key Policies\
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.