CVE-2009-3475

Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

• CWE-310

• http://secunia.com/advisories/36855Vendor Advisory
• http://secunia.com/advisories/36861Vendor Advisory
• http://secunia.com/advisories/36876Vendor Advisory
• http://shibboleth.internet2.edu/secadv/secadv_20090817.txtVendor Advisory
• http://www.debian.org/security/2009/dsa-1895
• http://www.debian.org/security/2009/dsa-1896
• http://secunia.com/advisories/36855Vendor Advisory
• http://secunia.com/advisories/36861Vendor Advisory
• http://secunia.com/advisories/36876Vendor Advisory
• http://shibboleth.internet2.edu/secadv/secadv_20090817.txtVendor Advisory
• http://www.debian.org/security/2009/dsa-1895
• http://www.debian.org/security/2009/dsa-1896

Published

Sep 29, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3469Cross-site scripting (XSS) vulnerability in profiles/html/si…
• CVE-2009-3470IBM Informix Dynamic Server (IDS) 10.00 before 10.00.xC11, 1…
• CVE-2009-3471IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9…
• CVE-2009-3472IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 al…
• CVE-2009-3473IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER p…
• CVE-2009-3474OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, a…
• CVE-2009-3476Buffer overflow in OpenSAML before 1.1.3 as used in Internet…
• CVE-2009-3477The Blackberry Browser in RIM BlackBerry Device Software 4.5…
• CVE-2009-3478Argument injection vulnerability in (1) src/content/js/conne…
• CVE-2009-3479Cross-site scripting (XSS) vulnerability in Bibliography (Bi…
• CVE-2009-3480SQL injection vulnerability in the iCRM Basic (com_icrmbasic…
• CVE-2009-3481A certain interface in the iCRM Basic (com_icrmbasic) compon…