CVE:CVE-2009-3476
CNNVD:CNNVD-200910-065
OpenSAML 1.1.3版本之前的版本中存在缓冲区溢出，当在Internet2 Shibboleth Service Provider software 1.3.4版本之前的1.3.x版本运行及在XMLTooling 1.2.2版本之前的版本在Internet2 Shibboleth Service Provider software 2.2.1版本之前的2.x版本中运行时,允许远程攻击者借助一个畸形编码的URL，造成拒绝服务并可能执行任意代码。
solution:Upgrade internet2 shibboleth-sp to a higher version than 1.3.1,1.3.2,1.3.3,1.3f,2.0,2.1,2.2,and avoid the version 1.3.1,1.3.2,1.3.3,1.3f,2.0,2.1,2.2; Upgrade internet2 opensaml to a higher version than 1.1,1.1.1,and avoid the version 1.1,1.1.1; Upgrade internet2 xmltooling to a higher version than 1.0.1,1.1.0,1.1.1,1.2.0,1.2.1,and avoid the version 1.0.1,1.1.0,1.1.1,1.2.0,1.2.1