NVD

Id
50675  
Name
CVE-2009-3474  
Description
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element"s Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-09-29  
Modified Date
2009-09-30  
Seq
2009-3474  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
256140 50675 CVE-2009-3474 http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt  View
256141 50675 CVE-2009-3474 DSA-1895  View
256142 50675 CVE-2009-3474 DSA-1896  View
256143 50675 CVE-2009-3474 36516  View
256144 50675 CVE-2009-3474 opensaml-keydescriptor-security-bypass(53474)  View
256145 50675 CVE-2009-3474 https://bugs.internet2.edu/jira/browse/CPPOST-28  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
44000 JVNDB-2009-005007 Internet2 Shibboleth Service Provider における符号および暗号の証明書を使用される脆弱性 Internet2 Shibboleth Service Provider で使用される OpenSAML および XMLTooling は、KeyDescriptor 要素の Use 属性に準拠しないため、証明書を符号と暗号のいずれか一つにのみ使用する際に証明書のセキュリティアプリケーション強度を弱めるため、符号および暗号の証明書を使用される脆弱性が存在します。 CVE-2009-3474 40905 CVE-2009-3474 50675 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005007.html 2009-09-29 2012-09-25 View