Lucene search
RedhatCVE-2014-3504HistoryAug 19, 2014 - 6:55 p.m.
CVE-2014-3504
2014-08-1918:55:02
redhat
web.nvd.nist.gov
46
cve-2014-3504
serf
ssl certificate issuer
ssl certificate subject
ssl server spoofing
nvd
x.509 certificate
man-in-the-middle attack
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
8
Confidence
High
EPSS
0.001
Percentile
31.7%
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject’s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Affected configurations
Node
apachesubversionMatch1.4.0
ORapachesubversionMatch1.4.1
ORapachesubversionMatch1.4.2
ORapachesubversionMatch1.4.3
ORapachesubversionMatch1.4.4
ORapachesubversionMatch1.4.5
ORapachesubversionMatch1.4.6
ORapachesubversionMatch1.5.0
ORapachesubversionMatch1.5.1
ORapachesubversionMatch1.5.2
ORapachesubversionMatch1.5.3
ORapachesubversionMatch1.5.4
ORapachesubversionMatch1.5.5
ORapachesubversionMatch1.5.6
ORapachesubversionMatch1.5.7
ORapachesubversionMatch1.5.8
ORapachesubversionMatch1.6.0
ORapachesubversionMatch1.6.1
ORapachesubversionMatch1.6.2
ORapachesubversionMatch1.6.3
ORapachesubversionMatch1.6.4
ORapachesubversionMatch1.6.5
ORapachesubversionMatch1.6.6
ORapachesubversionMatch1.6.7
ORapachesubversionMatch1.6.8
ORapachesubversionMatch1.6.9
ORapachesubversionMatch1.6.10
ORapachesubversionMatch1.6.11
ORapachesubversionMatch1.6.12
ORapachesubversionMatch1.6.13
ORapachesubversionMatch1.6.14
ORapachesubversionMatch1.6.15
ORapachesubversionMatch1.6.16
ORapachesubversionMatch1.6.17
ORapachesubversionMatch1.6.18
ORapachesubversionMatch1.6.19
ORapachesubversionMatch1.6.20
ORapachesubversionMatch1.6.21
ORapachesubversionMatch1.6.23
ORapachesubversionMatch1.7.0
ORapachesubversionMatch1.7.1
ORapachesubversionMatch1.7.2
ORapachesubversionMatch1.7.3
ORapachesubversionMatch1.7.4
ORapachesubversionMatch1.7.5
ORapachesubversionMatch1.7.6
ORapachesubversionMatch1.7.7
ORapachesubversionMatch1.7.8
ORapachesubversionMatch1.7.9
ORapachesubversionMatch1.7.10
ORapachesubversionMatch1.7.11
ORapachesubversionMatch1.7.12
ORapachesubversionMatch1.7.13
ORapachesubversionMatch1.7.14
ORapachesubversionMatch1.7.15
ORapachesubversionMatch1.7.16
ORapachesubversionMatch1.7.17
ORapachesubversionMatch1.8.0
ORapachesubversionMatch1.8.1
ORapachesubversionMatch1.8.2
ORapachesubversionMatch1.8.3
ORapachesubversionMatch1.8.4
ORapachesubversionMatch1.8.5
ORapachesubversionMatch1.8.6
ORapachesubversionMatch1.8.7
ORapachesubversionMatch1.8.8
ORapachesubversionMatch1.8.9
Node
canonicalubuntu_linuxMatch12.04-lts
ORcanonicalubuntu_linuxMatch14.04lts
Node
serf_projectserfMatch0.2.0
ORserf_projectserfMatch0.3.0
ORserf_projectserfMatch0.3.1
ORserf_projectserfMatch0.4.0
ORserf_projectserfMatch0.5.0
ORserf_projectserfMatch0.6.0
ORserf_projectserfMatch0.6.1
ORserf_projectserfMatch0.7.0
ORserf_projectserfMatch0.7.1
ORserf_projectserfMatch0.7.2
ORserf_projectserfMatch1.0.0
ORserf_projectserfMatch1.0.1
ORserf_projectserfMatch1.0.2
ORserf_projectserfMatch1.0.3
ORserf_projectserfMatch1.1.0
ORserf_projectserfMatch1.1.1
ORserf_projectserfMatch1.2.0
ORserf_projectserfMatch1.2.1
ORserf_projectserfMatch1.3.0
ORserf_projectserfMatch1.3.1
ORserf_projectserfMatch1.3.2
ORserf_projectserfMatch1.3.3
ORserf_projectserfMatch1.3.4
ORserf_projectserfMatch1.3.5
ORserf_projectserfMatch1.3.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| apache | subversion | 1.4.0 | cpe:2.3:a:apache:subversion:1.4.0:*:*:*:*:*:*:* |
| apache | subversion | 1.4.1 | cpe:2.3:a:apache:subversion:1.4.1:*:*:*:*:*:*:* |
| apache | subversion | 1.4.2 | cpe:2.3:a:apache:subversion:1.4.2:*:*:*:*:*:*:* |
| apache | subversion | 1.4.3 | cpe:2.3:a:apache:subversion:1.4.3:*:*:*:*:*:*:* |
| apache | subversion | 1.4.4 | cpe:2.3:a:apache:subversion:1.4.4:*:*:*:*:*:*:* |
| apache | subversion | 1.4.5 | cpe:2.3:a:apache:subversion:1.4.5:*:*:*:*:*:*:* |
| apache | subversion | 1.4.6 | cpe:2.3:a:apache:subversion:1.4.6:*:*:*:*:*:*:* |
| apache | subversion | 1.5.0 | cpe:2.3:a:apache:subversion:1.5.0:*:*:*:*:*:*:* |
| apache | subversion | 1.5.1 | cpe:2.3:a:apache:subversion:1.5.1:*:*:*:*:*:*:* |
| apache | subversion | 1.5.2 | cpe:2.3:a:apache:subversion:1.5.2:*:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-updates/2014-08/msg00038.html
secunia.com/advisories/59584
secunia.com/advisories/60721
ubuntu.com/usn/usn-2315-1
www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
www.securityfocus.com/bid/69238
groups.google.com/forum/#%21topic/serf-dev/NvgPoK6sFsc
security.gentoo.org/glsa/201610-05
subversion.apache.org/security/CVE-2014-3522-advisory.txt
Related
securityvulns
securityvulns
[USN-2315-1] serf vulnerability
2014-08-26 00:00:00
serf certificate name spoofing vulnerability
2014-08-26 00:00:00
nessus
nessus
FreeBSD : serf -- SSL Certificate Null Byte Poisoning (69048656-2187-11e4-802c-20cf30e32f6d)
2014-08-12 00:00:00
Ubuntu 14.04 LTS : serf vulnerability (USN-2315-1)
2014-08-15 00:00:00
Mandriva Linux Security Advisory : serf (MDVSA-2015:127)
2015-03-30 00:00:00
cvelist
cvelist
CVE-2014-3504
2014-08-19 18:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-2315-1)
2014-08-15 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-397)
2015-09-08 00:00:00
Fedora Update for libserf FEDORA-2014-9367
2014-08-23 00:00:00
amazon
amazon
Medium: libserf
2014-09-03 14:37:00
veracode
veracode
Man-In-The-Middle
2020-12-06 03:32:45
ubuntucve
ubuntucve
CVE-2014-3504
2014-08-12 00:00:00
freebsd
freebsd
serf -- SSL Certificate Null Byte Poisoning
2014-08-06 00:00:00
debiancve
debiancve
CVE-2014-3504
2014-08-19 18:55:02
fedora
fedora
[SECURITY] Fedora 20 Update: libserf-1.3.7-1.fc20
2014-08-23 01:59:00
mageia
mageia
Updated serf packages fix CVE-2014-3504
2014-08-27 03:04:56
osv
osv
libserf-1-1-1.3.9-1.2 on GA media
2024-06-15 00:00:00
nvd
nvd
CVE-2014-3504
2014-08-19 18:55:02
prion
prion
Design/Logic Flaw
2014-08-19 18:55:00
ubuntu
ubuntu
serf vulnerability
2014-08-14 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1979
2021-07-02 18:11:52
gentoo
gentoo
Subversion, Serf: Multiple Vulnerabilities
2016-10-11 00:00:00
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
8
Confidence
High
EPSS
0.001
Percentile
31.7%
Related for CVE-2014-3504