CVE-2009-4440

2009-12-2819:30:00

CWE-362

[email protected]

web.nvd.nist.gov

cve-2009-4440

directory proxy server

sun java system

enterprise edition

remote attackers

hijack

authenticated user

long binds

bug ids 6828462

6823593

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.4 Medium

AI Score

Confidence

Low

0.014 Low

EPSS

Percentile

86.4%

JSON

Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to “long binds,” aka Bug Ids 6828462 and 6823593.

Affected configurations

NVD

Node

sunjava_system_directory_serverMatch6.0enterprise

sunjava_system_directory_serverMatch6.1enterprise

sunjava_system_directory_serverMatch6.2enterprise

sunjava_system_directory_serverMatch6.3enterprise

CPENameOperatorVersion
sun:java_system_directory_serversun java system directory servereq6.0
sun:java_system_directory_serversun java system directory servereq6.1
sun:java_system_directory_serversun java system directory servereq6.2
sun:java_system_directory_serversun java system directory servereq6.3

CPE	Name	Operator	Version
sun:java_system_directory_server	sun java system directory server	eq	6.0
sun:java_system_directory_server	sun java system directory server	eq	6.1
sun:java_system_directory_server	sun java system directory server	eq	6.2
sun:java_system_directory_server	sun java system directory server	eq	6.3