fkie_cve-2009-3474
Vulnerability from fkie_nvd
Published
2009-09-29 23:30
Modified
2025-04-09 00:30
Severity ?
Summary
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
References
cve@mitre.orghttp://secunia.com/advisories/36855Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/36868Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/36876Vendor Advisory
cve@mitre.orghttp://shibboleth.internet2.edu/secadv/secadv_20090817a.txtPatch, Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1895Patch
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1896Patch
cve@mitre.orghttp://www.securityfocus.com/bid/36516Patch
cve@mitre.orghttps://bugs.internet2.edu/jira/browse/CPPOST-28
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/53474
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36855Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36868Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36876Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://shibboleth.internet2.edu/secadv/secadv_20090817a.txtPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1895Patch
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1896Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36516Patch
af854a3a-2127-422b-91ae-364da2661108https://bugs.internet2.edu/jira/browse/CPPOST-28
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/53474
Impacted products
Vendor Product Version
internet2 opensaml 2.0
internet2 opensaml 2.1.0
internet2 opensaml 2.2.0
internet2 xmltooling 1.0.1
internet2 xmltooling 1.1.0
internet2 xmltooling 1.1.1
internet2 xmltooling 1.2.0
internet2 shibboleth-sp 1.3.1
internet2 shibboleth-sp 1.3.2
internet2 shibboleth-sp 1.3b
internet2 shibboleth-sp 1.3f
internet2 shibboleth-sp 2.0
internet2 shibboleth-sp 2.1
internet2 shibboleth-sp 2.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:internet2:opensaml:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "258372E2-533F-46CB-B25A-5ECB3CC2F22F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:opensaml:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1122AD73-8FDD-4387-A237-B493CE0D547E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:opensaml:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0192C838-FD63-4CF7-9BF0-9BAFF101C612",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2D36F93-B9DE-422C-AD73-3D8AA58DB6BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5FCBF08-0DD9-4899-B4F5-5D7BFB0B5830",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5457FF44-CB80-486B-B3B2-D40F34565976",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:xmltooling:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C3A371A-AF3E-44E5-8854-C5D61FF5660C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE02AD93-8ED6-46F1-81D8-B70CB9EB79BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6CF3BEC-262B-4901-8D73-D8BB1869A166",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3b:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6EE490F-9E85-44F9-9608-86D4FBDAD331",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:1.3f:*:*:*:*:*:*:*",
              "matchCriteriaId": "4515685C-B170-4829-9261-8FAD5C9F1874",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FC9CB94-188C-4BE2-AD8E-EBBA5BA3731E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9E3DA80-673A-47D7-BDE2-0AC112BB6C4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:internet2:shibboleth-sp:2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "673CCD0B-9202-4EBA-96B2-11A438E8D464",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element\u0027s Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate."
    },
    {
      "lang": "es",
      "value": "OpenSAML v2.x anterior a v2.2.1 y XMLTooling v1.x anterior a v1.2.1, utilizado por Internet2 Shibboleth Service Provider v2.x anterior a v2.2.1,no siguen el atributo Use del elemento KeyDescriptor, lo cual permite a atacantes remotos utilizar un certificado para la firma y encriptaci\u00f3n, cuando esta designado para un solo fin, debilitando potencialmente el prop\u00f3sito de aplicaci\u00f3n de seguridad del certificado."
    }
  ],
  "id": "CVE-2009-3474",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-09-29T23:30:00.217",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36855"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36868"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36876"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2009/dsa-1895"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2009/dsa-1896"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/36516"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugs.internet2.edu/jira/browse/CPPOST-28"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53474"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36855"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36868"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36876"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2009/dsa-1895"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2009/dsa-1896"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/36516"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.internet2.edu/jira/browse/CPPOST-28"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53474"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.