CVE-2009-2856

Sun Virtual Desktop Infrastructure 3.0 - Unauthenticated Exposure of Sensitive Information via LDAP Session Sniffing

Title source: llm
STIX 2.1

Description

Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted connection, which might allow remote attackers to read cleartext VDI configuration-data requests by sniffing LDAP sessions on the network.

References (4)

Core 4
Core References
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2282
Patch, Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265488-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36330

Scores

EPSS 0.0020
EPSS Percentile 41.9%

Details

CWE
CWE-200
Status published
Products (1)
sun/virtual_desktop_infrastructure 3.0
Published Aug 18, 2009
Tracked Since Feb 18, 2026