CVE-2009-3476
published 2009-09-29CVE-2009-3476: Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in…
PriorityP342critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.10%
89.5th percentile
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | opensaml | < opensaml 3.0.0-2 (bookworm) | opensaml 3.0.0-2 (bookworm) |
| debian | shibboleth-sp | < opensaml 3.0.0-2 (bookworm) | opensaml 3.0.0-2 (bookworm) |
| debian | xmltooling | < opensaml 3.0.0-2 (bookworm) | opensaml 3.0.0-2 (bookworm) |
| internet2 | opensaml | — | — |
| internet2 | opensaml | — | — |
| internet2 | opensaml | >= 0 < 3.0.0-2 | 3.0.0-2 |
| internet2 | opensaml | >= 0 < 3.0.0-2 | 3.0.0-2 |
| internet2 | opensaml | >= 0 < 3.0.0-2 | 3.0.0-2 |
| internet2 | opensaml | >= 0 < 3.0.0-2 | 3.0.0-2 |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | — | — |
| internet2 | shibboleth-sp | >= 0 < 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
| internet2 | shibboleth-sp | >= 0 < 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
| internet2 | shibboleth-sp | >= 0 < 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
| internet2 | shibboleth-sp | >= 0 < 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
| internet2 | xmltooling | — | — |
| internet2 | xmltooling | — | — |
| internet2 | xmltooling | — | — |
| internet2 | xmltooling | — | — |
| internet2 | xmltooling | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_debian9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hvmf-6hr8-vcpv: Buffer overflow in OpenSAML before 1
ghsa_unreviewed·2022-05-02
CVE-2009-3476 [HIGH] CWE-119 GHSA-hvmf-6hr8-vcpv: Buffer overflow in OpenSAML before 1
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
OSV
CVE-2009-3476: Buffer overflow in OpenSAML before 1
osv·2009-09-29·CVSS 9.3
CVE-2009-3476 [CRITICAL] CVE-2009-3476: Buffer overflow in OpenSAML before 1
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Debian
CVE-2009-3476: opensaml - Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service...
vendor_debian·2009·CVSS 9.3
CVE-2009-3476 [CRITICAL] CVE-2009-3476: opensaml - Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service...
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Scope: local
bookworm: resolved (fixed in 3.0.0-2)
bullseye: resolved (fixed in 3.0.0-2)
forky: resolved (fixed in 3.0.0-2)
sid: resolved (fixed in 3.0.0-2)
trixie: resolved (fixed in 3.0.0-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/36869http://secunia.com/advisories/36870http://shibboleth.internet2.edu/secadv/secadv_20090826.txthttp://www.securityfocus.com/bid/36514https://exchange.xforce.ibmcloud.com/vulnerabilities/53471http://secunia.com/advisories/36869http://secunia.com/advisories/36870http://shibboleth.internet2.edu/secadv/secadv_20090826.txthttp://www.securityfocus.com/bid/36514https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
2009-09-29
Published