CVE-2014-3596

Severity

57%

Complexity

86%

Confidentiality

81%

CWE-297: Improper Validation of Certificate with Host Mismatch

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

CWE-297: Improper Validation of Certificate with Host Mismatch

CVSS 2.0 Base Score 5.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N).

Overview

First reported 10 years ago

2014-08-27 00:55:00

Last updated 5 years ago

2020-01-15 20:15:00

Affected Software

Apache Software Foundation Axis 1.0

1.0

Apache Software Foundation Axis 1.0 beta

1.0

Apache Software Foundation Axis 1.0 release candidate 1

1.0

Apache Software Foundation Axis 1.0 release candidate 2

1.0

Apache Software Foundation Axis 1.1

1.1

Apache Software Foundation Axis 1.1 beta

1.1

Apache Software Foundation Axis 1.1 release candidate 1

1.1

Apache Software Foundation Axis 1.1 release candidate 2

1.1

Apache Software Foundation Axis 1.2

1.2

Apache Software Foundation Axis 1.2 alpha

1.2

Apache Software Foundation Axis 1.2 beta1

1.2

Apache Software Foundation Axis 1.2 beta2

1.2

Apache Software Foundation Axis 1.2 beta3

1.2

Apache Software Foundation Axis 1.2 release candidate 1

1.2

Apache Software Foundation Axis 1.2 release candidate 2

1.2

Apache Software Foundation Axis 1.2 release candidate 3

1.2

Apache Software Foundation Axis 1.2.1

1.2.1

Apache Software Foundation Axis 1.3

1.3

Apache Software Foundation Axis

References

http://linux.oracle.com/errata/ELSA-2014-1193.html

openSUSE-SU-2019:1497

openSUSE-SU-2019:1526

RHSA-2014:1193

61222

[oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack

69295

1030745

apache-axis-cve20143596-spoofing(95377)

https://issues.apache.org/jira/browse/AXIS-2905

Patch

[axis-java-dev] 20190503 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596

[axis-java-dev] 20190909 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596

[axis-java-dev] 20190907 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596

[axis-java-dev] 20190909 [jira] [Resolved] (AXIS-2905) Insecure certificate validation CVE-2014-3596

[axis-java-dev] 20190503 [jira] [Comment Edited] (AXIS-2905) Insecure certificate validation CVE-2014-3596

https://www.oracle.com/security-alerts/cpujan2020.html

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.