Unscored severity · published Sep 29, 2009
CVE-2009-3476
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth…
–
CVSS
4.1%
EPSS
No
On KEV
Description
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensaml · Internet2
1.1; 1.1.1 · source: NVD
SH
Shibboleth-sp · Internet2
1.3.1; 1.3.2; 1.3.3; 1.3f; 2.0; 2.1; +1 more · source: NVD
XM
Xmltooling · Internet2
1.0.1; 1.1.0; 1.1.1; 1.2.0; 1.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3476
Vendor Advisory
http://secunia.com/advisories/36869
Vendor Advisory
http://secunia.com/advisories/36870
Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090826.txt
www.securityfocus.com
http://www.securityfocus.com/bid/36514
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
More from Opensaml
–
CVE-2013-6440
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to…
–
CVE-2009-3474
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use…