Bug 1140438 (CVE-2014-3607)

Summary: CVE-2014-3607 vtldap/ldaptive: Hostname verification susceptible to MITM attack
Product: [Other] Security Response Reporter: David Jorm <djorm>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aneelica, mjc, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: vt-ldap 3.3.8, ldaptive 1.0.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-29 01:20:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1131826    

Description David Jorm 2014-09-11 01:43:24 UTC 
It was discovered that the implementation used by the vtldap/ldaptive project to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
Comment 1 David Jorm 2014-09-11 01:50:29 UTC 
Statement:

Not Vulnerable. This issue only affects vtldap/ldaptive, which is not included in any supported Red Hat products.
Comment 3 Arun Babu Neelicattu 2014-09-29 01:03:10 UTC 
Upstream Advisory:

http://shibboleth.net/community/advisories/secadv_20140919.txt

Upstream Issue:

vt-ldap
https://code.google.com/p/vt-middleware/issues/detail?id=226

ldaptive
https://code.google.com/p/vt-middleware/issues/detail?id=227
https://code.google.com/p/vt-middleware/issues/detail?id=228

Upstream Fix:

vt-ldap
https://code.google.com/p/vt-middleware/source/detail?r=3046

ldaptive
https://code.google.com/p/vt-middleware/source/detail?r=3052
https://code.google.com/p/vt-middleware/source/detail?r=3053
Comment 4 Arun Babu Neelicattu 2014-09-29 01:17:39 UTC 
Victims Record:

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3607.yaml