Vulnerability-Lookup

BDU:2015-02029 (CVE-2009-3300)

Vulnerability from fstec – Published: 2016-07-07 – Updated: 2016-11-28 – View on bdu.fstec.ru Fixed

Title

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить целостность защищаемой информации

Summary

Множественные уязвимости пакета libshibsp-dev операционной системы Debian GNU/Linux, эксплуатация которых может привести к нарушению целостности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена удаленно

Severity

2.6 (Low) CVSS 2.0


                      
                        AV:N/AC:H/Au:N/C:N/I:P/A:N

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-79 - Непринятие мер по защите структуры веб-страницы (или \«Межсайтовая сценарная атака\»)

Aliases

CVE-2009-3300, DSA-1947, ID:1400471

References

2 references

URL
http://www.debian.org/security/dsa-1947/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3300

Impacted products

1 product from 1 vendor

Vendors

Сообщество свободного программного обеспечения

Products

Debian GNU/Linux

Versions

до 4 (Debian GNU/Linux)

Product types

Operating system

Mitigations

Проблема может быть решена обновлением операционной системы до следующих версий пакетов в зависимости от архитектуры: Debian GNU/Linux 4: s390x: libapache2-mod-shib - 1.3f.dfsg1-2+etch2 libshib-dev - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 i686: libshib-dev - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 libapache2-mod-shib - 1.3f.dfsg1-2+etch2 arm: libshib-dev - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 libapache2-mod-shib - 1.3f.dfsg1-2+etch2 sparc: libapache2-mod-shib - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 libshib-dev - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 x86-64: libshib-dev - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 libapache2-mod-shib - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 ia64: libapache2-mod-shib - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 libshib-dev - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 alpha: libshib-dev - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 libapache2-mod-shib - 1.3f.dfsg1-2+etch2 mipsel: libshib-target5 - 1.3f.dfsg1-2+etch2 libapache2-mod-shib - 1.3f.dfsg1-2+etch2 libshib-dev - 1.3f.dfsg1-2+etch2 libshib6 - 1.3f.dfsg1-2+etch2 hppa: libshib6 - 1.3f.dfsg1-2+etch2 libapache2-mod-shib - 1.3f.dfsg1-2+etch2 libshib-target5 - 1.3f.dfsg1-2+etch2 libshib-dev - 1.3f.dfsg1-2+etch2 Debian GNU/Linux 5: ppc: libshib-target5 - 1.3.1.dfsg1-3+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 s390x: libsaml2 - 2.0-2+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libsaml2-dev - 2.0-2+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 opensaml2-tools - 2.0-2+lenny2 i686: libshibsp-dev - 2.0.dfsg1-4+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libsaml2 - 2.0-2+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libsaml2-dev - 2.0-2+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 opensaml2-tools - 2.0-2+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 hppa: libsaml2-dev - 2.0-2+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libsaml2 - 2.0-2+lenny2 opensaml2-tools - 2.0-2+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 sparc: libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 opensaml2-tools - 2.0-2+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libsaml2-dev - 2.0-2+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libsaml2 - 2.0-2+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 x86-64: libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libsaml2-dev - 2.0-2+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 opensaml2-tools - 2.0-2+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libsaml2 - 2.0-2+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 armel: libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libsaml2-dev - 2.0-2+lenny2 opensaml2-tools - 2.0-2+lenny2 libsaml2 - 2.0-2+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 alpha: libshib-dev - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 ia64: libshibsp1 - 2.0.dfsg1-4+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 libsaml2-dev - 2.0-2+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 opensaml2-tools - 2.0-2+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libsaml2 - 2.0-2+lenny2 mips: libsaml2-dev - 2.0-2+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libsaml2 - 2.0-2+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 opensaml2-tools - 2.0-2+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 noarch: libsaml2-doc - 2.0-2+lenny2 opensaml2-schemas - 2.0-2+lenny2 libshibsp-doc - 2.0.dfsg1-4+lenny2 shibboleth-sp2-schemas - 2.0.dfsg1-4+lenny2 mipsel: libshib-target5 - 1.3.1.dfsg1-3+lenny2 opensaml2-tools - 2.0-2+lenny2 libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 libsaml2-dev - 2.0-2+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libsaml2 - 2.0-2+lenny2 arm: libapache2-mod-shib2 - 2.0.dfsg1-4+lenny2 libshib-dev - 1.3.1.dfsg1-3+lenny2 libshib6 - 1.3.1.dfsg1-3+lenny2 libapache2-mod-shib - 1.3.1.dfsg1-3+lenny2 libsaml2-dev - 2.0-2+lenny2 libshib-target5 - 1.3.1.dfsg1-3+lenny2 opensaml2-tools - 2.0-2+lenny2 libshibsp-dev - 2.0.dfsg1-4+lenny2 libsaml2 - 2.0-2+lenny2 libshibsp1 - 2.0.dfsg1-4+lenny2

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 4 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b:\nDebian GNU/Linux 4:\n\ts390x:\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\ti686:\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\tarm:\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\tsparc:\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\tx86-64:\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\tia64:\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\talpha:\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\tmipsel:\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\thppa:\n\t\tlibshib6 - 1.3f.dfsg1-2+etch2\n\t\tlibapache2-mod-shib - 1.3f.dfsg1-2+etch2\n\t\tlibshib-target5 - 1.3f.dfsg1-2+etch2\n\t\tlibshib-dev - 1.3f.dfsg1-2+etch2\nDebian GNU/Linux 5:\n\tppc:\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\ts390x:\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\ti686:\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\thppa:\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\tsparc:\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\tx86-64:\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\tarmel:\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\talpha:\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\tia64:\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\tmips:\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\tnoarch:\n\t\tlibsaml2-doc - 2.0-2+lenny2\n\t\topensaml2-schemas - 2.0-2+lenny2\n\t\tlibshibsp-doc - 2.0.dfsg1-4+lenny2\n\t\tshibboleth-sp2-schemas - 2.0.dfsg1-4+lenny2\n\tmipsel:\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\tarm:\n\t\tlibapache2-mod-shib2 - 2.0.dfsg1-4+lenny2\n\t\tlibshib-dev - 1.3.1.dfsg1-3+lenny2\n\t\tlibshib6 - 1.3.1.dfsg1-3+lenny2\n\t\tlibapache2-mod-shib - 1.3.1.dfsg1-3+lenny2\n\t\tlibsaml2-dev - 2.0-2+lenny2\n\t\tlibshib-target5 - 1.3.1.dfsg1-3+lenny2\n\t\topensaml2-tools - 2.0-2+lenny2\n\t\tlibshibsp-dev - 2.0.dfsg1-4+lenny2\n\t\tlibsaml2 - 2.0-2+lenny2\n\t\tlibshibsp1 - 2.0.dfsg1-4+lenny2",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": null,
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2016",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.07.2016",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-02029",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2009-3300, DSA-1947, ID:1400471",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Debian\u00a0GNU/Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b (\u0438\u043b\u0438 \\\u00ab\u041c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u0430\u044f \u0441\u0446\u0435\u043d\u0430\u0440\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430\\\u00bb) (CWE-79)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 libshibsp-dev \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Debian\u00a0GNU/Linux, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438  \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.debian.org/security/dsa-1947/\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3300",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-79",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 2,6)"
}

CVE-2009-3300 (GCVE-0-2009-3300)

Vulnerability from cvelistv5 – Published: 2009-11-06 15:00 – Updated: 2024-08-07 06:22

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

5 references

URL	Tags
http://www.debian.org/security/2009/dsa-1947	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/37237	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2009/3150	vdb-entryx_refsource_VUPEN
http://shibboleth.internet2.edu/secadv/secadv_200…	x_refsource_CONFIRM

Date Public

2009-11-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:22:24.229Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1947",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1947"
          },
          {
            "name": "37237",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37237"
          },
          {
            "name": "identity-url-xss(54140)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54140"
          },
          {
            "name": "ADV-2009-3150",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3150"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://shibboleth.internet2.edu/secadv/secadv_20091104.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-11-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-1947",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1947"
        },
        {
          "name": "37237",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37237"
        },
        {
          "name": "identity-url-xss(54140)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54140"
        },
        {
          "name": "ADV-2009-3150",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3150"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://shibboleth.internet2.edu/secadv/secadv_20091104.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-3300",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-1947",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1947"
            },
            {
              "name": "37237",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37237"
            },
            {
              "name": "identity-url-xss(54140)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54140"
            },
            {
              "name": "ADV-2009-3150",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3150"
            },
            {
              "name": "http://shibboleth.internet2.edu/secadv/secadv_20091104.txt",
              "refsource": "CONFIRM",
              "url": "http://shibboleth.internet2.edu/secadv/secadv_20091104.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-3300",
    "datePublished": "2009-11-06T15:00:00.000Z",
    "dateReserved": "2009-09-22T00:00:00.000Z",
    "dateUpdated": "2024-08-07T06:22:24.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2015-02029 (CVE-2009-3300)

CVE-2009-3300 (GCVE-0-2009-3300)

Tags

Sightings

Nomenclature

Related by attack behaviour