The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

Updated serf packages fix security vulnerability :

Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2014-3504).

This subversion and libserf update fixes several security and non security issues :

  - subversion: guard against md5 hash collisions when     finding cached credentials [bnc#889849] [CVE-2014-3528]

  - subversion: ra_serf: properly match wildcards in SSL     certs. [bnc#890511] [CVE-2014-3522]

  - libserf: Handle NUL bytes in fields of an X.509     certificate. [bnc#890510] [CVE-2014-3504]

Serf 1.3.7 [2014-08-11]

  - Handle NUL bytes in fields of an X.509 certificate.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

serf Development list reports :

Serf provides APIs to retrieve information about a certificate. These APIs return the information as NUL terminated strings (commonly called C strings). X.509 uses counted length strings which may include a NUL byte. This means that a library user will interpret any information as ending upon seeing this NUL byte and will only see a partial value for that field.

Attackers could exploit this vulnerability to create a certificate that a client will accept for a different hostname than the full certificate is actually for by embedding a NUL byte in the certificate.

This can lead to a man-in-the-middle attack. There are no known instances of this problem being exploited in the wild and in practice it should be difficult to actually exploit this vulnerability.

ID	Name	Product	Family	Severity
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
82380	Mandriva Linux Security Advisory : serf (MDVSA-2015:127)	Nessus	Mandriva Local Security Checks	medium
78340	Amazon Linux AMI : libserf (ALAS-2014-397)	Nessus	Amazon Linux Local Security Checks	medium
77645	Mandriva Linux Security Advisory : serf (MDVSA-2014:166)	Nessus	Mandriva Local Security Checks	medium
77364	openSUSE Security Update : libserf / subversion (openSUSE-SU-2014:1059-1)	Nessus	SuSE Local Security Checks	medium
77349	Fedora 20 : libserf-1.3.7-1.fc20 (2014-9367)	Nessus	Fedora Local Security Checks	medium
77218	Ubuntu 14.04 LTS : serf vulnerability (USN-2315-1)	Nessus	Ubuntu Local Security Checks	medium
77124	FreeBSD : serf -- SSL Certificate Null Byte Poisoning (69048656-2187-11e4-802c-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-3504

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium