Secunia

Wietse Venema has discovered a vulnerability in Apache-SSL, which can be exploited by malicious people to forge client certificates.

The problem is that client certificates can be forged using real basic authentication if "SSLFakeBasicAuth" is used and presentation of certificates is optional ("SSLVerifyClient" set to "1" or "3").

Successful exploitation requires knowledge of a valid user's "one-line DN" (Distinguished Name) and the fixed password ("password" by default).

Version 1.3.28+1.52 and prior are affected.

Solution
Update to version 1.3.29+1.53.
Further details available in Customer Area

Provided and/or discovered by
Wietse Venema

Original Advisory
http://www.apache-ssl.org/advisory-20040206.txt

Deep Links
Links available in Customer Area