CVEvulnerability
CVE-2009-3476
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-09-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Affected configurations
• internet2 shibboleth-sp 1.3.1
• internet2 shibboleth-sp 1.3.2
• internet2 shibboleth-sp 1.3.3
• internet2 shibboleth-sp 1.3f
• internet2 opensaml 1.1
• internet2 opensaml 1.1.1
• internet2 xmltooling 1.0.1
• internet2 xmltooling 1.1.0
• internet2 xmltooling 1.1.1
• internet2 xmltooling 1.2.0
• internet2 xmltooling 1.2.1
• internet2 shibboleth-sp 2.0
• internet2 shibboleth-sp 2.1
• internet2 shibboleth-sp 2.2
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://secunia.com/advisories/36869 Vendor Advisory
- http://secunia.com/advisories/36870 Vendor Advisory
- http://shibboleth.internet2.edu/secadv/secadv_20090826.txt Vendor Advisory
- http://www.securityfocus.com/bid/36514 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53471 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/36869 Vendor Advisory
- http://secunia.com/advisories/36870 Vendor Advisory
- http://shibboleth.internet2.edu/secadv/secadv_20090826.txt Vendor Advisory
- http://www.securityfocus.com/bid/36514 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53471 exchange.xforce.ibmcloud.com