medium
5.8
CWE
297
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2014-3596

First published: Thu Aug 14 2014(Updated: )

Apache Axis and Axis2 could allow a remote attacker to conduct spoofing attacks, caused by and incomplete fix related to the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server.

Credit: secalert@redhat.com secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Apache Axis<=1.4
Apache Axis=1.0
Apache Axis=1.0-beta
Apache Axis=1.0-rc1
Apache Axis=1.0-rc2
Apache Axis=1.1
Apache Axis=1.1-beta
Apache Axis=1.1-rc1
Apache Axis=1.1-rc2
Apache Axis=1.2
Apache Axis=1.2-alpha
Apache Axis=1.2-beta1
Apache Axis=1.2-beta2
Apache Axis=1.2-beta3
Apache Axis=1.2-rc1
Apache Axis=1.2-rc2
Apache Axis=1.2-rc3
Apache Axis=1.2.1
Apache Axis=1.3
maven/axis:axis<=1.4
maven/org.apache.axis:axis<=1.4
IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Remedy

https://issues.apache.org/jira/browse/AXIS-2905

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2014-3596?

    CVE-2014-3596 is a vulnerability in Apache Axis and Axis2 that allows a remote attacker to conduct spoofing attacks.

  • What is the severity of CVE-2014-3596?

    The severity of CVE-2014-3596 is medium with a CVSS score of 5.8.

  • How does CVE-2014-3596 affect Apache Axis?

    CVE-2014-3596 affects Apache Axis versions up to and including 1.4.

  • How can the CVE-2014-3596 vulnerability be fixed?

    To fix the CVE-2014-3596 vulnerability, it is recommended to upgrade to a patched version of Apache Axis.

  • Where can I find more information about CVE-2014-3596?

    You can find more information about CVE-2014-3596 at the following references: [link1], [link2], [link3].

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203