PT-2009-6562 · Oracle · Sun Java System Directory Server Enterprise Edition

Published 2009-12-28 · Updated 2010-06-13 · CVE-2009-4441

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Directory Server Enterprise Edition versions 6.0 through 6.3.1

Description The issue is related to the Directory Proxy Server (DPS) not enabling the SO KEEPALIVE socket option, which can lead to a denial of service (connection slot exhaustion) via multiple connections from remote attackers.

Recommendations For versions 6.0 through 6.3.1, consider enabling the SO KEEPALIVE socket option to prevent connection slot exhaustion. As a temporary workaround, restrict the number of connections to the Directory Proxy Server to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2009-4441

Affected Products

Sun Java System Directory Server Enterprise Edition

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-4441 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270789-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1 · Patch
• http://secunia.com/advisories/37915 · Note
• http://securitytracker.com/id?1023389 · Note
• http://vupen.com/english/advisories/2009/3647 · Note
• http://securityfocus.com/bid/37481 · Note