CVE-2009-3475 - CVE House
Back to Database
Status published High CVE-2009-3475

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x...

Vulnerability Description

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-3475

Credits & Attribution

No credits recorded in the NVD database.

References

More from internet2

View All →
CVE-2018-19794
Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2...
Medium 6.1
CVE-2013-6440
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4)...
Medium 5
CVE-2009-3476
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2...
Critical 9.3
CVE-2009-3474
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as...
High 7.5
CVE-2009-3300
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP)...
Low 2.6

Affected Vendor

Affected Software

shibboleth-sp
Vulnerable Versions:
1.3.1, 1.3.2, 1.3f, 2.0, 2.1, 2.2

Timeline

Official Publish: September 29th, 2009
Last Modified: September 17th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.