ID CVE-2009-3475
Summary Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
References
Vulnerable Configurations
  • cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:internet2:shibboleth-sp:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:internet2:shibboleth-sp:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:internet2:shibboleth-sp:1.3f:*:*:*:*:*:*:*
    cpe:2.3:a:internet2:shibboleth-sp:1.3f:*:*:*:*:*:*:*
  • cpe:2.3:a:internet2:shibboleth-sp:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:internet2:shibboleth-sp:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:internet2:shibboleth-sp:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:internet2:shibboleth-sp:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:internet2:shibboleth-sp:2.2:*:*:*:*:*:*:*
    cpe:2.3:a:internet2:shibboleth-sp:2.2:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 30-09-2009 - 04:00)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
confirm http://shibboleth.internet2.edu/secadv/secadv_20090817.txt
debian
  • DSA-1895
  • DSA-1896
secunia
  • 36855
  • 36861
  • 36876
Last major update 30-09-2009 - 04:00
Published 29-09-2009 - 23:30
Last modified 30-09-2009 - 04:00
Back to Top