Unrated severityNVD Advisory· Published Sep 29, 2009· Updated Apr 23, 2026
CVE-2009-3475
CVE-2009-3475
Description
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected products
6cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:1.3f:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:2.2:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- secunia.com/advisories/36855nvdVendor Advisory
- secunia.com/advisories/36861nvdVendor Advisory
- secunia.com/advisories/36876nvdVendor Advisory
- shibboleth.internet2.edu/secadv/secadv_20090817.txtnvdVendor Advisory
- www.debian.org/security/2009/dsa-1895nvd
- www.debian.org/security/2009/dsa-1896nvd
News mentions
0No linked articles in our index yet.