Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1129935 - (CVE-2014-3596) CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-578...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20140819,repo...
: Security
Depends On: 1129981 1129984 1129971 1129979 1129980 1129982 1129983 1129985 1129986 1129987 1129988 1129989 1129993 1129995 1134761 1134762 1219514
Blocks: 1130120 1134386 1196328 1220827
  Show dependency tree / graph
 
Reported: 2014-08-13 23:27 EDT by David Jorm
Modified: 2018-11-05 17:39 EST (History)
32 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1193 normal SHIPPED_LIVE Important: axis security update 2014-09-15 15:40:17 EDT
Red Hat Product Errata RHSA-2015:1010 normal SHIPPED_LIVE Important: Red Hat JBoss Portal 6.2.0 security update 2015-05-14 15:14:11 EDT

  None (edit)
Description David Jorm 2014-08-13 23:27:37 EDT 
It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
Comment 1 David Jorm 2014-08-13 23:31:13 EDT 
Statement:

Note that Axis 1 is EOL upstream, and the incomplete patch for CVE-2012-5784 was never merged upstream. It was, however, shipped by various vendors, including Debian and Red Hat. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1164433

Acknowledgements:

This issue was discovered by David Jorm and Arun Neelicattu of Red Hat Product Security.
Comment 4 Tomas Hoger 2014-08-27 08:44:16 EDT 
The original issue CVE-2012-5784 was tracked via bug 873252.

This problem is similar to Apache HttpComponents Client / Apache/Jakarta Commons HttpClient issue CVE-2014-3577, see bug 1129074 comment 23 for technical details.
Comment 6 Martin Prpič 2014-09-04 05:52:21 EDT 
IssueDescription:

It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Comment 7 errata-xmlrpc 2014-09-15 11:40:42 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:1193 https://rhn.redhat.com/errata/RHSA-2014-1193.html
Comment 9 errata-xmlrpc 2015-05-14 11:14:17 EDT 
This issue has been addressed in the following products:

  JBoss Portal 6.2.0

Via RHSA-2015:1010 https://rhn.redhat.com/errata/RHSA-2015-1010.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.