PT-2009-5214 · Sun · Sun Virtual Desktop Infrastructure

Publicado 2009-08-18 · Atualizado 2009-08-21 · CVE-2009-2856

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Virtual Desktop Infrastructure (VDI) version 3.0

Description The issue occurs when anonymous binding is enabled, and the software fails to properly handle a client's attempt to establish an authenticated and encrypted connection. This might allow remote attackers to read cleartext VDI configuration-data requests by sniffing LDAP sessions on the network.

Recommendations For Sun Virtual Desktop Infrastructure (VDI) version 3.0, consider disabling anonymous binding to prevent remote attackers from reading cleartext VDI configuration-data requests. As a temporary workaround, restrict access to the LDAP sessions on the network to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-2856

Produtos afetados

Sun Virtual Desktop Infrastructure

Referências · 5

• http://vupen.com/english/advisories/2009/2282 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2856 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-02-1 · Correção
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-265488-1 · Aviso do Fabricante
• http://secunia.com/advisories/36330 · Aviso do Fabricante