Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2009-3476: Shibboleth Service Provider can crash or be hijacked via URL
CVE-2009-3476 · published 17 years ago
Summary
Debian packages OpenSAML, Shibboleth Service Provider, and XMLTooling are affected by a flaw that lets a specially crafted web address cause the service to stop working or potentially run unwanted code. Update OpenSAML to version 1.1.3 or later, Shibboleth Service Provider to 1.3.4 (or 2.2.1 for newer releases), and XMLTooling to 1.2.2 or later to remove the risk.
What to do
- Update debian opensaml to version 3.0.0-2.
- Update debian shibboleth-sp to version 3.0.2+dfsg1-2.
- Update debian xmltooling to version 1.2.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | opensaml |
< 3.0.0-2 Fix: upgrade to 3.0.0-2
|
| Debian:13 | debian | opensaml |
< 3.0.0-2 Fix: upgrade to 3.0.0-2
|
| Debian:14 | debian | opensaml |
< 3.0.0-2 Fix: upgrade to 3.0.0-2
|
| Debian:12 | debian | shibboleth-sp |
< 3.0.2+dfsg1-2 Fix: upgrade to 3.0.2+dfsg1-2
|
| Debian:13 | debian | shibboleth-sp |
< 3.0.2+dfsg1-2 Fix: upgrade to 3.0.2+dfsg1-2
|
| Debian:14 | debian | shibboleth-sp |
< 3.0.2+dfsg1-2 Fix: upgrade to 3.0.2+dfsg1-2
|
| Debian:12 | debian | xmltooling |
< 1.2.2-1 Fix: upgrade to 1.2.2-1
|
| Debian:13 | debian | xmltooling |
< 1.2.2-1 Fix: upgrade to 1.2.2-1
|
| Debian:14 | debian | xmltooling |
< 1.2.2-1 Fix: upgrade to 1.2.2-1
|
| – | internet2 | shibboleth-sp |
1.3.1 1.3.2 1.3.3 1.3f 2.0 2.1 2.2 cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:* |
| – | internet2 | opensaml |
1.1 1.1.1 cpe:2.3:a:internet2:opensaml:1.1:*:*:*:*:*:*:* |
| – | internet2 | xmltooling |
1.0.1 1.1.0 1.1.1 1.2.0 1.2.1 cpe:2.3:a:internet2:xmltooling:1.0.1:*:*:*:*:*:*:* |
Original advisory text
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider s...
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
References
- https://security-tracker.debian.org/tracker/CVE-2009-3476 Vendor Advisory
- http://secunia.com/advisories/36869 Vendor Advisory
- http://secunia.com/advisories/36870 Vendor Advisory
- http://shibboleth.internet2.edu/secadv/secadv_20090826.txt Vendor Advisory
- http://www.securityfocus.com/bid/36514
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
Severity
9.3
Critical
Type
CWE-119Buffer Overflow
Timeline
Published29 Sep 2009
Updated23 Oct 2026
First seen17 Sep 2026
Track software like this
Free during beta