CVE-2009-3475 Security feature bypass in n/a
Remote attackers can spoof SSL servers via crafted certificates when PKIX trust validation is enabled, bypassing security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3475?
CVE-2009-3475 is a high-severity vulnerability in n/a, published on 29 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Weakness: CWE-310
Which versions are affected by CVE-2009-3475?
It affects 1 product.
Products include Internet2 Shibboleth-Sp.
How do I fix CVE-2009-3475?
Upgrade to a fixed version.
Is CVE-2009-3475 being exploited?
There is no known exploitation of CVE-2009-3475 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2009-3475, GHSA-g23p-47j7-w4hw.