http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jakarta-commons-httpclient, httpcomponents-core: missing HTTPS connection timeout (CVE-2015-5262)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of WebSphere Application Server installed on the remote host is 8.0.x through 8.0.0.15, 8.5.x prior to 8.5.5.20, or 9.0.x prior to 9.0.5.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 6453091 advisory, including the following:

  - http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the     http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause     a denial of service (HTTPS call hang) via unspecified vectors. (CVE-2015-5262)

  - org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and     HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in     the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via a CN= string in a field in the distinguished name (DN) of a     certificate, as demonstrated by the foo,CN=www.apache.org string in the O field. (CVE-2014-3577)

  - http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify     that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field     of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate     with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists     because of an incomplete fix for CVE-2012-5783. (CVE-2012-6153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for apache-commons-httpclient fixes the following issues :

- http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service   (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]

  - org.apache.http.conn.ssl.AbstractVerifier does not     properly verify that the server hostname matches a     domain name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate, which     allows MITM attackers to spoof SSL servers via a 'CN='     string in a field in the distinguished name (DN) of a     certificate. [bsc#1178171, CVE-2014-3577]

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for apache-commons-httpclient fixes the following issues :

- http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service   (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262]

  - org.apache.http.conn.ssl.AbstractVerifier does not     properly verify that the server hostname matches a     domain name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate, which     allows MITM attackers to spoof SSL servers via a 'CN='     string in a field in the distinguished name (DN) of a     certificate. [bsc#1178171, CVE-2014-3577]

This update was imported from the SUSE:SLE-15:Update update project.

An update of the commons package has been released.

According to the version of the jakarta-commons-httpclient package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - http/conn/ssl/SSLConnectionSocketFactory.java in Apache     HttpComponents HttpClient before 4.3.6 ignores the     http.socket.timeout configuration setting during an SSL     handshake, which allows remote attackers to cause a     denial of service (HTTPS call hang) via unspecified     vectors.(CVE-2015-5262)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the jakarta-commons-httpclient package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Hyper-Text Transfer Protocol (HTTP) is perhaps the     most significant protocol used on the Internet today.
    Web services, network-enabled appliances and the growth     of network computing continue to expand the role of the     HTTP protocol beyond user-driven web browsers, and     increase the number of applications that may require     HTTP support.Although the java.net package provides     basic support for accessing resources via HTTP, it     doesn't provide the full flexibility or functionality     needed by many applications. The Jakarta Commons HTTP     Client component seeks to fill this void by providing     an efficient,up-to-date, and feature-rich package     implementing the client side of the most recent HTTP     standards and recommendations.Designed for extension     while providing robust support for the base HTTP     protocol, the HTTP Client component may be of interest     to anyone building HTTP-aware client applications such     as web browsers, web service clients, or systems that     leverage or extend the HTTP protocol for distributed     communication.Security     Fix(es):http/conn/ssl/SSLConnectionSocketFactory.java     in Apache HttpComponents HttpClient before 4.3.6     ignores the http.socket.timeout configuration setting     during an SSL handshake, which allows remote attackers     to cause a denial of service (HTTPS call hang) via     unspecified vectors.(CVE-2015-5262)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the httpcomponents-client package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - http/conn/ssl/SSLConnectionSocketFactory.java in Apache     HttpComponents HttpClient before 4.3.6 ignores the     http.socket.timeout configuration setting during an SSL     handshake, which allows remote attackers to cause a     denial of service (HTTPS call hang) via unspecified     vectors.(CVE-2015-5262)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2769-1 advisory.

    It was discovered that Apache Commons HttpClient did not properly verify the Common Name or subjectAltName     fields of X.509 certificates. An attacker could exploit this to perform a machine-in-the-middle attack to     view sensitive information or alter encrypted communications. This issue only affected Ubuntu 12.04 LTS.
    (CVE-2012-5783)

    Florian Weimer discovered the fix for CVE-2012-5783 was incomplete for Apache Commons HttpClient. An     attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or     alter encrypted communications. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-6153)

    Subodh Iyengar and Will Shackleton discovered the fix for CVE-2012-5783 was incomplete for Apache Commons     HttpClient. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive     information or alter encrypted communications. (CVE-2014-3577)

    It was discovered that Apache Commons HttpClient did not properly handle read timeouts during HTTPS     handshakes. A remote attacker could trigger this flaw to cause a denial of service. (CVE-2015-5262)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes CVE-2015-5262 denial of service security vulnerability by respectinc configured SO_TIMEOUT parameter during SSL handshake.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Trevin Beattie [1] discovered an issue where one could observe hanging threads in a multi-threaded Java application. After debugging the issue, it became evident that the hanging threads were caused by the SSL initialization code in commons-httpclient.

This upload fixes this issue by respecting the configured SO_TIMEOUT during SSL handshakes with the server.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1259892

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198566	RHEL 5 : jakarta-commons-httpclient (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
149787	IBM WebSphere Application Server 8.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.20 / 9.0.x < 9.0.5.8 Multiple Vulnerabilities	Nessus	Web Servers	high
142638	openSUSE Security Update : apache-commons-httpclient (openSUSE-2020-1875)	Nessus	SuSE Local Security Checks	medium
142629	openSUSE Security Update : apache-commons-httpclient (openSUSE-2020-1873)	Nessus	SuSE Local Security Checks	medium
140702	Photon OS 3.0: Commons PHSA-2020-3.0-0141	Nessus	PhotonOS Local Security Checks	medium
133910	EulerOS 2.0 SP5 : jakarta-commons-httpclient (EulerOS-SA-2020-1109)	Nessus	Huawei Local Security Checks	medium
131889	EulerOS 2.0 SP2 : jakarta-commons-httpclient (EulerOS-SA-2019-2397)	Nessus	Huawei Local Security Checks	medium
131671	EulerOS 2.0 SP2 : httpcomponents-client (EulerOS-SA-2019-2518)	Nessus	Huawei Local Security Checks	medium
129220	EulerOS 2.0 SP3 : jakarta-commons-httpclient (EulerOS-SA-2019-2027)	Nessus	Huawei Local Security Checks	medium
86401	Ubuntu 14.04 LTS : Apache Commons HttpClient vulnerabilities (USN-2769-1)	Nessus	Ubuntu Local Security Checks	medium
86230	Fedora 23 : jakarta-commons-httpclient-3.1-23.fc23 (2015-15590)	Nessus	Fedora Local Security Checks	medium
86229	Fedora 22 : jakarta-commons-httpclient-3.1-23.fc22 (2015-15589)	Nessus	Fedora Local Security Checks	medium
86228	Fedora 21 : jakarta-commons-httpclient-3.1-20.fc21 (2015-15588)	Nessus	Fedora Local Security Checks	medium
86225	Debian DLA-322-1 : commons-httpclient security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-5262

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium