CVE-2014-3694

What it actually does

The SSL/TLS plugins fail to enforce the Basic Constraints extension when validating X.509 server certificates, allowing a certificate that claims to be a CA to be accepted as an end-entity certificate.

Why it matters to the business

Attackers positioned on the network can intercept and read or alter traffic that should have been protected by encryption, exposing credentials, messages, and other data in transit.

How an attack unfolds

An attacker intercepts the TLS handshake, presents a crafted certificate that lacks or misuses the Basic Constraints extension, and the client accepts the certificate as valid, establishing an encrypted session under attacker control.

How to fix it

Upgrade the affected package to the fixed version 11.2.202.481ubuntu0.14.04.1 or later; rebuild or reinstall any dependent applications that embed the vulnerable library.

How to confirm the fix worked

Confirm the installed package version is at or above the fixed release, then perform a manual certificate validation test using a certificate that contains an invalid Basic Constraints extension.

Typical attack path

1. Position on the network path between client and legitimate server
2. Intercept the outgoing TLS connection attempt
3. Generate or obtain a certificate that omits or misrepresents the Basic Constraints extension
4. Present the crafted certificate during the handshake
5. Complete the TLS session and relay or inspect decrypted traffic

How to detect it

Review system and application logs for TLS handshake events that occurred before the patch date; look for connections that succeeded with certificates later found to lack proper constraints.

What your security team should do

• Apply the vendor-supplied update immediately on all systems running the affected package
• Scan the environment for any remaining instances of the vulnerable version
• Review network logs for unexpected TLS sessions to external hosts after the patch window