CVE-2009-3474

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/36855Vendor Advisory
http://secunia.com/advisories/36868Vendor Advisory
http://secunia.com/advisories/36876Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090817a.txtPatch, Vendor Advisory
http://www.debian.org/security/2009/dsa-1895Patch
http://www.debian.org/security/2009/dsa-1896Patch
http://www.securityfocus.com/bid/36516Patch
https://bugs.internet2.edu/jira/browse/CPPOST-28
https://exchange.xforce.ibmcloud.com/vulnerabilities/53474
http://secunia.com/advisories/36855Vendor Advisory
http://secunia.com/advisories/36868Vendor Advisory
http://secunia.com/advisories/36876Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090817a.txtPatch, Vendor Advisory
http://www.debian.org/security/2009/dsa-1895Patch
http://www.debian.org/security/2009/dsa-1896Patch
http://www.securityfocus.com/bid/36516Patch
https://bugs.internet2.edu/jira/browse/CPPOST-28
https://exchange.xforce.ibmcloud.com/vulnerabilities/53474

Timeline

Published: Sep 29, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-34757.5Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly CVE-2009-34769.3Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before CVE-2009-34776.8The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 befor CVE-2009-34786.0Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP E CVE-2009-34794.3Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows re CVE-2009-34807.5SQL injection vulnerability in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! allows remote attackers to execute arbitrary SQ CVE-2009-34817.5A certain interface in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! does not require administrative authentication, which h CVE-2009-34827.8TrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGR CVE-2009-34839.3Heap-based buffer overflow in the Create New Site feature in GlobalSCAPE CuteFTP Professional, Home, and Lite 8.3.3 and 8.3.3.0054 allows us CVE-2009-34849.3Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname i CVE-2009-34854.3Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbi CVE-2009-34863.5Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inj