The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.1.7 FP8, 11.2.4 FP3, or 12.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7123154, including the following:

  - When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the   allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using   Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which   addresses this issue. (CVE-2023-39410)

  - In order to decrypt SM2 encrypted data an application is expected to call the API function   EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the   'out' parameter can be NULL and, on exit, the 'outlen' parameter is populated with the buffer size required   to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call   EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the 'out' parameter. A bug in the   implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the   plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by   the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a   second time with a buffer that is too small. A malicious attacker who is able present SM2 content for   decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of   62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour   or causing the application to crash. The location of the buffer is application dependent but is typically   heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). (CVE-2021-3711)

  - SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
  Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using   SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend   upgrading to version 2.0 and beyond. (CVE-2022-1471)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.0, or 17.7.x through 17.12.x prior to 17.12.11.2, or 18.8.x prior to 18.8.15, or 19.12.x prior to 19.12.0.1. It is, therefore, affected by multiple vulnerabilities:

  - A Polymorphic Typing issue was discovered in FasterXML     jackson-databind before 2.9.10 used in Primavera Unifier.
    (CVE-2019-14540)

  - A memory exhaustion flaw exists in Apache Tika's RecursiveParserWrapper     versions 1.7 - 1.21 used in Primavera Unifier. (CVE-2019-10088)

  - A Server Side Request Forgery (SSRF) vulnerability affected the     Apache Axis 1.4 distribution that was last released in 2006. Security     and bug commits commits continue in the projects Axis 1.x Subversion     repository, legacy users are encouraged to build from source. The     successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is     not vulnerable to this issue. (CVE-2019-0227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.18, 16.x prior to 16.2.11, 17.x prior to 17.12.6, or 18.x prior to 18.8.8.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Two Polymorphic Typing issues present in FasterXML jackson-databind related to     com.zaxxer.hikari.HikariDataSource which can be exploited by remote, unauthenticated attackers.
    (CVE-2019-16335, CVE-2019-14540)

  - A man-in-the-middle vulnerability caused by the getCN function in Apache Axis not properly verifying that     the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of     the X.509 certificate. An unauthenticated, remote attacker can exploit this to spoof SSL servers via a     certificate with a subject that specifies a common name in a field that is not a CN field. (CVE-2014-3596)

  - A Server Side Request Forgery (SSRF) vulnerability in Apache Axis that can be exploited by an     unauthenticated, remote attacker. (CVE-2019-0227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for axis fixes the following issues :

Security issue fixed :

  - CVE-2012-5784, CVE-2014-3596: Fixed missing connection     hostname check against X.509 certificate name     (bsc#1134598).

This update was imported from the SUSE:SLE-12:Update update project.

This update for axis fixes the following issues :

Security issue fixed :

  - CVE-2012-5784, CVE-2014-3596: Fixed missing connection     hostname check against X.509 certificate name     (bsc#1134598).

This update was imported from the SUSE:SLE-15:Update update project.

A vulnerability was fixed in axis, a SOAP implementation in Java :

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.

Thanks to Markus Koschany for providing the fixed package and David Jorm and Arun Neelicattu (Red Hat Product Security) for providing the patch.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3596)

It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3596)

Applications using Apache Axis must be restarted for this update to take effect.

Updated axis packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Apache Axis is an implementation of SOAP (Simple Object Access Protocol). It can be used to build both web service clients and servers.

It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3596)

For additional information on this flaw, refer to the Knowledgebase article in the References section.

This issue was discovered by David Jorm and Arun Neelicattu of Red Hat Product Security.

All axis users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using Apache Axis must be restarted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1193 advisory.

    - Resolves: CVE-2014-3596

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
193868	IBM Cognos Analytics 11.1.1 < 11.1.7 FP8 / 11.2.x < 11.2.4 FP3 / 12.0.x < 12.0.2 (7123154)	Nessus	CGI abuses	critical
133359	Oracle Primavera Unifier Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	CGI abuses	critical
132936	Oracle Primavera Gateway Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	CGI abuses	critical
125793	openSUSE Security Update : axis (openSUSE-2019-1526)	Nessus	SuSE Local Security Checks	medium
125695	openSUSE Security Update : axis (openSUSE-2019-1497)	Nessus	SuSE Local Security Checks	medium
93256	F5 Networks BIG-IP : Apache Axis vulnerability (SOL16821)	Nessus	F5 Networks Local Security Checks	medium
82153	Debian DLA-169-1 : axis security update	Nessus	Debian Local Security Checks	medium
78355	Amazon Linux AMI : axis (ALAS-2014-412)	Nessus	Amazon Linux Local Security Checks	medium
77700	Scientific Linux Security Update : axis on SL5.x, SL6.x i386/x86_64 (20140915)	Nessus	Scientific Linux Local Security Checks	medium
77695	RHEL 5 / 6 : axis (RHSA-2014:1193)	Nessus	Red Hat Local Security Checks	medium
77694	Oracle Linux 5 / 6 : axis (ELSA-2014-1193)	Nessus	Oracle Linux Local Security Checks	medium
77692	CentOS 5 / 6 : axis (CESA-2014:1193)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2014-3596

medium

Tenable Plugins

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium