NVD

Id
31766  
Name
CVE-2014-3596  
Description
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-08-26  
Modified Date
2017-01-06  
Seq
2014-3596  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167363 31766 CVE-2014-3596 http://linux.oracle.com/errata/ELSA-2014-1193.html  View
167364 31766 CVE-2014-3596 RHSA-2014:1193  View
167365 31766 CVE-2014-3596 61222  View
167366 31766 CVE-2014-3596 [oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack  View
167367 31766 CVE-2014-3596 69295  View
167368 31766 CVE-2014-3596 1030745  View
167369 31766 CVE-2014-3596 apache-axis-cve20143596-spoofing(95377)  View
167370 31766 CVE-2014-3596 https://issues.apache.org/jira/browse/AXIS-2905  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15084 JVNDB-2014-003959 Apache Axis の getCN 関数における SSL サーバになりすまされる脆弱性 Apache Axis の getCN 関数は、サーバのホスト名が X.509 証明書のサブジェクトの Common Name (CN) または subjectAltName フィールドのドメイン名と一致することを適切に検証しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2014-3596 70884 CVE-2014-3596 31766 5.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003959.html 2014-08-19 2015-04-22 View