CVE-2014-3596: Medium severity apache axis vulnerability

Published Aug 14, 2014
·
Updated

Apache Axis and Axis2 could allow a remote attacker to conduct spoofing attacks, caused by and incomplete fix related to the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.

Other sources

It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.

Red Hat

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

GitHub

Affected Software

22 affected components
Apache Axis<=1.4
Apache Axis=1.0
Apache Axis=1.0-beta
Apache Axis=1.0-rc1
Apache Axis=1.0-rc2
Apache Axis=1.1
Apache Axis=1.1-beta
Apache Axis=1.1-rc1
Apache Axis=1.1-rc2
Apache Axis=1.2
Apache Axis=1.2-alpha
Apache Axis=1.2-beta1
Apache Axis=1.2-beta2
Apache Axis=1.2-beta3
Apache Axis=1.2-rc1
Apache Axis=1.2-rc2
Apache Axis=1.2-rc3
Apache Axis=1.2.1
Apache Axis=1.3
maven/axis:axis<=1.4
maven/org.apache.axis:axis<=1.4
IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Event History

Aug 14, 2014
Data Sourced
via Red Hat·03:27 AM
DescriptionSeverityAffected Software
Aug 27, 2014
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Oct 16, 2018
Advisory Published
via GitHub·08:50 PM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2014-3596?

CVE-2014-3596 is a vulnerability in Apache Axis and Axis2 that allows a remote attacker to conduct spoofing attacks.

2

What is the severity of CVE-2014-3596?

The severity of CVE-2014-3596 is medium with a CVSS score of 5.8.

3

How does CVE-2014-3596 affect Apache Axis?

CVE-2014-3596 affects Apache Axis versions up to and including 1.4.

4

How can the CVE-2014-3596 vulnerability be fixed?

To fix the CVE-2014-3596 vulnerability, it is recommended to upgrade to a patched version of Apache Axis.

5

Where can I find more information about CVE-2014-3596?

You can find more information about CVE-2014-3596 at the following references: [link1], [link2], [link3].

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203