|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
Apache-SSL contains a flaw that may permit a client to use real basic authentication to forge a client certificate. The flaw is present only when SSLVerifyClient is set to 1 or 3 and SSLFakeBasicAuth is set.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Authentication Management
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
|
|
Technical |
Apache-SSL 1.3.28+1.52 contains a flaw that may permit a client to use real basic authentication to forge a client certificitate. If Apache-SSL is configured with SSLVerifyClient set to 1 or 3 (client certificates optional) and SSLFakeBasicAuth, Apache-SSL 1.3.28+1.52 and all earlier versions would permit a client to use real basic authentication to forge a client certificate.
The attacker needs to have the "one-line DN" of a valid user, as used
by faked basic auth in Apache-SSL, and the fixed password ("password"
by default).
|
|
Solution |
Upgrade to version Apache-SSL 1.3.29+1.53 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
Apache-SSL
 |
1.2.x+1.xx |
1.3.1x+1.xx |
1.3.22+1.4x |
1.3.24+1.48 |
1.3.26+1.48 |
1.3.27+1.48 |
1.3.28+1.49 |
1.3.28+1.51 |
1.3.28+1.52 |
1.3.x+1.xx |
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
