CVE

Id
70892  
CVE No.
CVE-2014-3596  
Status
Candidate  
Description
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.  
Phase
Assigned (20140514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
675305 70892 CVE-2014-3596 MLIST:[oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack  View
675306 70892 CVE-2014-3596 URL:http://www.openwall.com/lists/oss-security/2014/08/20/2  View
675307 70892 CVE-2014-3596 MISC:https://issues.apache.org/jira/browse/AXIS-2905  View
675308 70892 CVE-2014-3596 CONFIRM:http://linux.oracle.com/errata/ELSA-2014-1193.html  View
675309 70892 CVE-2014-3596 REDHAT:RHSA-2014:1193  View
675310 70892 CVE-2014-3596 URL:http://rhn.redhat.com/errata/RHSA-2014-1193.html  View
675311 70892 CVE-2014-3596 BID:69295  View
675312 70892 CVE-2014-3596 URL:http://www.securityfocus.com/bid/69295  View
675313 70892 CVE-2014-3596 SECTRACK:1030745  View
675314 70892 CVE-2014-3596 URL:http://www.securitytracker.com/id/1030745  View
675315 70892 CVE-2014-3596 SECUNIA:61222  View
675316 70892 CVE-2014-3596 URL:http://secunia.com/advisories/61222  View
675317 70892 CVE-2014-3596 XF:apache-axis-cve20143596-spoofing(95377)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16203 JVNDB-2014-005078 Not Yet Commons SSL の Certificates.java における SSL サーバになりすまされる脆弱性 Not Yet Commons SSL の Certificates.java は、ホスト名が X.509 証明書のサブジェクトの Common Name (CN) フィールドのドメイン名と一致することを適切に検証しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2014-3604 70892 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005078.html  View