CVE-2012-5817 Improper Input Validation in XFire
HighCVSS 7.4
EPSS 0.78%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.codehaus.xfire/xfire-core(Maven) | <= 1.2.6 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.0 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.0-M5 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.0-RC1 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.1 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.1-RC1 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.1-beta-1 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.1.1 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.1.2 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2-RC | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2.1 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2.2 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2.3 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2.4 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2.5 | No fix listed |
| org.codehaus.xfire/xfire-core(Maven) | = 1.2.6 | No fix listed |
| Amazon ec2 api tools java library | All versions | No fix listed |
| codehaus xfire | <= 1.2.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- xfire-ssl-spoofing(79934) third-party-advisory vdb-entry
- www.cs.utexas.edu exploit
- github.com