Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	56408
Class:	Design Error
CVE:	CVE-2012-5784 CVE-2012-5785
Remote:	Yes
Local:	No
Published:	Nov 06 2012 12:00AM
Updated:	Jul 06 2016 01:29PM
Credit:	Reported at the ACM CCS 2012 conference
Vulnerable:	RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 IBM IMS 10 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya Aura Communication Manager Utility Services 6.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager Utility Services 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager Utility Services 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2
Not Vulnerable:

Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability

Apache Axis and Axis2/Java are prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

The following versions are vulnerable:

Apache Axis 1.4
Apache Axis2/Java 1.6.2

Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability

References:

• Apache AXIS2 Homepage (Apache)
  
• Apache Axis2/Java - Homepage (Apache Software Foundation)
  
• Apache Homepage (Apache)
  
• Validating SSL Certificates in Non-Browser Software (ACM)
  
• axis security update (RHSA-2013-0683) (Avaya)
  
• Fix list for IBM Business Process Manager (BPM) Version 8.0 products (IBM)
  
• Moderate: jasperreports-server-pro security, bug fix, and enhancement update (Red Hat)
  
• Multiple vulnerabilities in Product IMS Enterprise Suite SOAP Gateway (IBM)
  
• PM78680; SPSS Modeler Premium - Text Analytics SSL Spoofing (IBM)
  
• Security Bulletin: An IBM Business Process Manager SSL connection can be establi (IBM)
  
• Security Bulletin: Apache Axis2 related vulnerability for IBM Tivoli Directory I (IBM)
  
• Security Bulletin: IBM SPSS Modeler Premium - Text Analytics SSL Spoofing (CVE-2 (IBM)
  
• Security Bulletin: InfoSphere Guardium Data Redaction affected by SSL vulnerabil (IBM)
  
• swg21965451 - Two vulnerabilities exist in IBM Case Foundation and FileNet Busin (IBM)