Unscored severity · published Aug 18, 2009
CVE-2009-2856
Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted connection, which might allow remote attackers to read cleartext VDI configuration-data requests by sniffing LDAP sessions on the network.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VD
Virtual Desktop Infrastructure · Sun
3.0; 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2856
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2856
Vendor Advisory
http://secunia.com/advisories/36330
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-02-1
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265488-1
Patch
http://www.vupen.com/english/advisories/2009/2282
More from Virtual Desktop Infrastructure
–
CVE-2009-3923
The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified…