Fluid Attacks Database

Description

Man-in-the-middle attack in Apache Axis Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	axis:axis	>=0 <=1.4	-
debian 12	axis	>=0 <1.4-16.1	1.4-16.1
maven	org.apache.axis:axis	>=0 <=1.4	-
debian 13	axis	>=0 <1.4-16.1	1.4-16.1
debian 14	axis	>=0 <1.4-16.1	1.4-16.1
rpm rhel5	axis	<0:1.2.1-2jpp.7.el5_9	0:1.2.1-2jpp.7.el5_9
rpm rhel6	axis	<0:1.2.1-7.3.el6_3	0:1.2.1-7.3.el6_3

Aliases

1. CVE-2012-57842. NVD-2012-57843. OSV-2012-57844. OSV-DEBIAN-2012-57845. GCVE-2012-57846. SECURITY-TRACKER-CVE-2012-5784

References

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/798292. https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5@%3Cjava-dev.axis.apache.org%3E3. https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780@%3Cjava-dev.axis.apache.org%3E4. https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832@%3Cjava-dev.axis.apache.org%3E5. https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d@%3Cjava-dev.axis.apache.org%3E6. https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c@%3Cjava-dev.axis.apache.org%3E7. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html8. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html9. http://rhn.redhat.com/errata/RHSA-2013-0269.html10. http://rhn.redhat.com/errata/RHSA-2013-0683.html11. http://rhn.redhat.com/errata/RHSA-2014-0037.html12. http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf13. http://www.securityfocus.com/bid/56408

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.