CVE-2009-3476: Buffer Overflow

Published Sep 29, 2009

Updated

Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.

Affected Software

14 affected components

Internet2 Shibboleth-sp=1.3.1

Internet2 Shibboleth-sp=1.3.2

Internet2 Shibboleth-sp=1.3.3

Internet2 Shibboleth-sp=1.3f

Internet2 OpenSAML=1.1

Internet2 OpenSAML=1.1.1

Internet2 XMLTooling=1.0.1

Internet2 XMLTooling=1.1.0

Internet2 XMLTooling=1.1.1

Internet2 XMLTooling=1.2.0

Internet2 XMLTooling=1.2.1

Internet2 Shibboleth-sp=2.0

Internet2 Shibboleth-sp=2.1

Internet2 Shibboleth-sp=2.2

Event History

Sep 29, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Data Sourced

11:30 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-3476?

CVE-2009-3476 has a medium severity as it allows remote attackers to potentially execute arbitrary code or cause a denial of service.

How do I fix CVE-2009-3476?

To fix CVE-2009-3476, upgrade to OpenSAML version 1.1.3 or higher, and XMLTooling version 1.2.2 or higher.

Which software is affected by CVE-2009-3476?

CVE-2009-3476 affects Internet2 Shibboleth Service Provider versions 1.3.x before 1.3.4 and 2.x before 2.2.1, as well as OpenSAML versions before 1.1.3.

Can CVE-2009-3476 lead to data breaches?

Yes, CVE-2009-3476 could potentially lead to data breaches by allowing attackers to execute arbitrary code.

Is CVE-2009-3476 exploitable remotely?

Yes, CVE-2009-3476 is exploitable remotely, which increases its risk to vulnerable systems.