PT-2012-6098 · Apache · Apache Cxf

CVE-2012-5786 · Publicado 2012-11-04 · Atualizado 2024-08-06

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.7.0

Description The issue arises from the wsdl first https sample code in Apache CXF, which fails to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. It is noted that the sample had specifically used a flag to bypass the DN check.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the wsdl first https sample code until a patch is available. Restrict access to SSL servers to minimize the risk of exploitation. Avoid using arbitrary valid certificates in the affected sample code until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-5786

Produtos afetados

Apache Cxf

Referências · 5

• https://t.me/cvenotify/89528 · Publicação no Telegram
• http://cs.utexas.edu/~shmat/shmat_ccs12.pdf · Nota
• https://t.me/cvenotify/83667 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2012-5786 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79983 · Nota