CVE-2009-2856

LowCVSS 3.5/10Last modified Jun 16, 2026

Description

Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted connection, which might allow remote attackers to read cleartext VDI configuration-data requests by sniffing LDAP sessions on the network.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/36330Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-02-1Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265488-1Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/2282Patch, Vendor Advisory
http://secunia.com/advisories/36330Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-02-1Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265488-1Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/2282Patch, Vendor Advisory

Timeline

Published: Aug 18, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-28575.5The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virt CVE-2009-28585.0Memory leak in the Security component in IBM DB2 8.1 before FP18 on Unix platforms allows attackers to cause a denial of service (memory con CVE-2009-28594.6IBM DB2 8.1 before FP18 allows attackers to obtain unspecified access via a das command.CVE-2009-28605.0Unspecified vulnerability in db2jds in IBM DB2 8.1 before FP18 allows remote attackers to cause a denial of service (service crash) via "mal CVE-2009-28617.3The Over-the-Air Provisioning (OTAP) functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly impleme CVE-2009-28624.3The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows r CVE-2009-28637.1Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication,CVE-2009-28647.8Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7.CVE-2009-28657.6Buffer overflow in the login implementation in the Extension Mobility feature in the Unified Communications Manager Express (CME) component CVE-2009-28667.8Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted CVE-2009-28677.8Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4T, 12.4XZ, and 12.4YA, when Zone-Based Policy Firewall SIP In CVE-2009-28687.8Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers