CVE-2014-3596: Medium severity apache axis vulnerability
Apache Axis and Axis2 could allow a remote attacker to conduct spoofing attacks, caused by and incomplete fix related to the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.
Other sources
It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
— Red Hat
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2014-3596?
CVE-2014-3596 is a vulnerability in Apache Axis and Axis2 that allows a remote attacker to conduct spoofing attacks.
What is the severity of CVE-2014-3596?
The severity of CVE-2014-3596 is medium with a CVSS score of 5.8.
How does CVE-2014-3596 affect Apache Axis?
CVE-2014-3596 affects Apache Axis versions up to and including 1.4.
How can the CVE-2014-3596 vulnerability be fixed?
To fix the CVE-2014-3596 vulnerability, it is recommended to upgrade to a patched version of Apache Axis.
Where can I find more information about CVE-2014-3596?
You can find more information about CVE-2014-3596 at the following references: [link1], [link2], [link3].