Bug 1131803 (CVE-2014-3604)

Summary: CVE-2014-3604 Not Yet Commons SSL: Hostname verification susceptible to MITM attack
Product: [Other] Security Response Reporter: Arun Babu Neelicattu <aneelica>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: grocha, mjc, pavelp, ppecka, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: commons-ssl 0.3.15 Doc Type: Bug Fix
Doc Text:
It was discovered that the implementation used by the Not Yet Commons SSL project to check that the server hostname matches the domain name in the subject's CN field was flawed. This could be exploited by a man-in-the-middle attacker by spoofing a valid certificate using a specially crafted subject.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-18 18:39:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1132747, 1132749    
Bug Blocks: 1131826, 1244362    

Description Arun Babu Neelicattu 2014-08-20 05:56:47 UTC
It was discovered that the implementation used by the Not Yet Commons SSL project to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.

Comment 1 David Jorm 2014-08-20 06:00:56 UTC
Acknowledgements:

This issue was discovered by Arun Babu Neelicattu of Red Hat Product Security.

Comment 2 Arun Babu Neelicattu 2014-08-20 07:44:59 UTC
Statement:

Red Hat JBoss SOA Platform 4 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Comment 4 Arun Babu Neelicattu 2014-08-22 01:54:02 UTC
Created not-yet-commons-ssl tracking bugs for this issue:

Affects: fedora-all [bug 1132747]

Comment 5 Arun Babu Neelicattu 2014-09-22 22:25:33 UTC
Upstream Commit:

http://juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172

Comment 6 Arun Babu Neelicattu 2014-09-22 22:36:30 UTC
Victims Record:

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml

Comment 10 errata-xmlrpc 2015-10-12 15:31:03 UTC
This issue has been addressed in the following products:

  Red Hat JBoss SOA Platform 5.3.1

Via RHSA-2015:1888 https://rhn.redhat.com/errata/RHSA-2015-1888.html