PT-2009-6674 · Shibboleth · Libshib-Target5+5

Matt Elder · Published 1970-01-01 · Updated 2017-08-17 · CVE-2009-3300

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shibboleth Identity Provider versions prior to 1.3.4 Shibboleth Identity Provider versions prior to 2.1.5 Shibboleth Service Provider versions prior to 1.3.5 Shibboleth Service Provider versions prior to 2.3 libshib6 (affected versions not specified) libshibsp1 (affected versions not specified) libshib-dev (affected versions not specified) libshib-target5 (affected versions not specified) libshibsp-dev (affected versions not specified)

Description The issue involves multiple vulnerabilities in the Shibboleth software, which can lead to a compromise of protected information. These vulnerabilities can be exploited remotely. Specifically, there are multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider and Service Provider components. These XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via URLs encountered in redirections and appear in automatically generated forms.

Recommendations For Shibboleth Identity Provider versions prior to 1.3.4, update to version 1.3.4 or later. For Shibboleth Identity Provider versions prior to 2.1.5, update to version 2.1.5 or later. For Shibboleth Service Provider versions prior to 1.3.5, update to version 1.3.5 or later. For Shibboleth Service Provider versions prior to 2.3, update to version 2.3 or later. For libshib6, libshibsp1, libshib-dev, libshib-target5, and libshibsp-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-02026

BDU:2015-02027

BDU:2015-02028

BDU:2015-02029

BDU:2015-02030

CVE-2009-3300

DSA-1947-1

Affected Products

Shibboleth Identity Provider

Shibboleth Service Provider

Libshib-Dev

Libshib-Target5

Libshib6

Libshibsp1

References · 16

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3300 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3300 · Security Note
• http://shibboleth.internet2.edu/secadv/secadv_20091104.txt · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3300 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02027 · Security Note
• http://debian.org/security/2009/dsa-1947 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3300 · Vendor Advisory
• http://secunia.com/advisories/37237 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3150 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02030 · Security Note
• https://bdu.fstec.ru/vul/2015-02028 · Security Note
• https://bdu.fstec.ru/vul/2015-02026 · Security Note
• https://bdu.fstec.ru/vul/2015-02029 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-3300 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54140 · Note