PT-2009-5768 · Internet2 · Shibboleth Service Provider

Chris Ries · Published 2009-09-29 · Updated 2009-09-30 · CVE-2009-3475

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Internet2 Shibboleth Service Provider software versions 1.3.x through 1.3.2 Internet2 Shibboleth Service Provider software versions 2.x through 2.2.0

Description The issue arises when the software uses PKIX trust validation and fails to properly handle a '0' character in the subject or subjectAltName fields of a certificate. This allows remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For versions 1.3.x through 1.3.2, update to version 1.3.3 or later. For versions 2.x through 2.2.0, update to version 2.2.1 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-3475

DSA-1895-1

DSA-1895-2

DSA-1896-1

Affected Products

Shibboleth Service Provider

References · 10

• http://secunia.com/advisories/36861 · Vendor Advisory
• http://debian.org/security/2009/dsa-1895 · Vendor Advisory
• http://debian.org/security/2009/dsa-1896 · Vendor Advisory
• http://secunia.com/advisories/36876 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3475 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3475 · Security Note
• http://secunia.com/advisories/36855 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3475 · Vendor Advisory
• http://shibboleth.internet2.edu/secadv/secadv_20090817.txt · Vendor Advisory