CVE-2009-3475: High severity shibboleth service provider vulnerability

Published Sep 29, 2009

Updated

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected Software

6 affected components

Internet2 Shibboleth-sp=2.2

Internet2 Shibboleth-sp=2.0

Internet2 Shibboleth-sp=1.3f

Internet2 Shibboleth-sp=1.3.2

Internet2 Shibboleth-sp=1.3.1

Internet2 Shibboleth-sp=2.1

Event History

Sep 29, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3475?

CVE-2009-3475 is considered a high severity vulnerability due to its potential for man-in-the-middle attacks.

How do I fix CVE-2009-3475?

To fix CVE-2009-3475, upgrade to Shibboleth Service Provider version 1.3.3 or 2.2.1 or later.

What products are affected by CVE-2009-3475?

CVE-2009-3475 affects Internet2 Shibboleth Service Provider software versions 1.3.x before 1.3.3 and 2.x before 2.2.1.

What kind of attack does CVE-2009-3475 enable?

CVE-2009-3475 allows remote man-in-the-middle attackers to spoof arbitrary SSL servers.

Is authentication compromised due to CVE-2009-3475?

Yes, CVE-2009-3475 compromises SSL certificate validation, which can lead to unauthorized access.