PT-2012-1252 · Apache+1 · Apache Commons Httpclient+1
Florian Weimer
·
Publicado
2012-11-20
·
Atualizado
2018-10-17
·
CVE-2012-6153
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Commons HttpClient versions prior to 4.2.3
Description
The issue is related to insufficient verification of input data in the Apache Commons HttpClient library, part of Apache HttpComponents. This allows a remote attacker to spoof SSL servers using a specially crafted certificate. The problem arises because the server hostname is not properly checked against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. Specifically, the
AbstractVerifier.java class does not correctly verify the server hostname when the common name is specified in a field other than the CN field.Recommendations
For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL connections to trusted servers with properly validated certificates. Avoid using the
AbstractVerifier.java class until a patch is applied.Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Commons Httpclient
Ubuntu