CVE-2009-3476
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 4.13% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- internet2/shibboleth-sp · internet2/opensaml · internet2/xmltooling
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/36869Vendor Advisory
- http://secunia.com/advisories/36870Vendor Advisory
- http://shibboleth.internet2.edu/secadv/secadv_20090826.txtVendor Advisory
- http://www.securityfocus.com/bid/36514
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
- http://secunia.com/advisories/36869Vendor Advisory
- http://secunia.com/advisories/36870Vendor Advisory
- http://shibboleth.internet2.edu/secadv/secadv_20090826.txtVendor Advisory
- http://www.securityfocus.com/bid/36514
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.