what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 26 - 40 of 40 RSS Feed

CVE-2014-3577

Status Candidate

Overview

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Related Files

Red Hat Security Advisory 2014-1891-01
Posted Nov 24, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1891-01 - Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS 6.0.3, and includes bug fixes and enhancements. It includes various bug fixes, which are listed in the README file included with the patch files. The following security issues are fixed with this release: It was discovered that Jakarta Commons HttpClient incorrectly extracted the host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | b592f8c8ee96a54967e2557353405052d49c187fecc92e620bc4dcf46ba2f8be
Red Hat Security Advisory 2014-1836-01
Posted Nov 10, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1836-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product Security.

tags | advisory, java, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 8d9a8727833060342b3f8edd5ac10693285691bfa1a25dffd384ca4ec9ca055e
Red Hat Security Advisory 2014-1835-01
Posted Nov 10, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1835-01 - Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product Security.

tags | advisory, java, web, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 34ebf02b86bcfadf0dda911f6cfe8461ad07a2197b7f98e263769eeda7c4badf
Red Hat Security Advisory 2014-1834-01
Posted Nov 10, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1834-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product Security.

tags | advisory, java, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 9a709e37af3cd03c5bec21c6eb01972b58c86cf4e2eba3b2061cc23171fb3001
Red Hat Security Advisory 2014-1833-01
Posted Nov 10, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1833-01 - Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product Security.

tags | advisory, java, web, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | c8e06ab40cb432221b15620ffd9997b1b168d8488e421d284b4d65d3f0834c47
Red Hat Security Advisory 2014-1323-01
Posted Sep 30, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1323-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 92df1e73009a4ef231fc9d81ad37190a44c9a141705134e0c72db689b03d346f
Red Hat Security Advisory 2014-1321-01
Posted Sep 30, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1321-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 0c20556b21ba57e1ddda02e0d395e7b90f5dbc9f1b48ce29319a38ae23838089
Red Hat Security Advisory 2014-1322-01
Posted Sep 30, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1322-01 - Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, web, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 2666c14c949bd578b89f6c32a38338e01e6137e4e5ed3e34fb2373fed0fcc34d
Red Hat Security Advisory 2014-1320-01
Posted Sep 30, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1320-01 - Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, web, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | d70d4f10e9a0cc9227e3a369e6438680f3daad0e07480ac9d4c01d03d0f2cdb1
Red Hat Security Advisory 2014-1166-01
Posted Sep 8, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1166-01 - Jakarta Commons HTTPClient implements the client side of HTTP standards. It was discovered that the HTTPClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. For additional information on this flaw, refer to the Knowledgebase article in the References section. All jakarta-commons-httpclient users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

tags | advisory, web, spoof
systems | linux, redhat
advisories | CVE-2014-3577
SHA-256 | 02e4ef7dbc33e50a64d3276088cff23aa33095d071c28cf5ce48616d0ade075e
Red Hat Security Advisory 2014-1146-01
Posted Sep 4, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1146-01 - HttpClient is an HTTP/1.1 compliant HTTP agent implementation based on httpcomponents HttpCore. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, web, spoof
systems | linux, redhat
advisories | CVE-2014-3577
SHA-256 | b7867964a0a320426a7d1f8a9bfd3437d615fa6349a8e17e24bda87e263a66f3
Red Hat Security Advisory 2014-1163-01
Posted Sep 4, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1163-01 - Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 173c01394ad2d26ec93b537c3d1d167a81624a45dd721129f0a9198503bc6a35
Red Hat Security Advisory 2014-1162-01
Posted Sep 4, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1162-01 - Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. It was discovered that the HttpClient incorrectly extracted host name from an X.509 certificate subject's Common Name field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | 9e860d7b7fbb3a0daaae325f717bd699f8f9b87320105a7dae1a021e295faa6c
Red Hat Security Advisory 2014-1082-01
Posted Aug 20, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1082-01 - Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot Java Virtual Machine with support for monitoring multiple JVM instances. The httpcomponents-client package provides an HTTP agent implementation that is used by Thermostat to visualize collected data in an HTTP-aware client application. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, web, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | bfae5fc3bb60d3716504aa9437504ce45b829444527176b89c73d86eb3a68576
Apache HttpComponents Man-In-The-Middle
Posted Aug 18, 2014
Authored by Subodh Iyengar

Apache HttpComponents (prior to revision 4.3.5/4.0.2) may be susceptible to a 'Man in the Middle Attack' due to a flaw in the default hostname verification during SSL/TLS when a specially crafted server side certificate is used.

tags | advisory
advisories | CVE-2014-3577
SHA-256 | 889514603cc555b13c01e72b05be1ebefa0cbf2ff89b15aa2ff8b3f9c2602bf1
Page 2 of 2
Back12Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close