CVE-2009-2856: Sun Virtual Desktop Infrastructure

Low severity, CVSS 3.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted connection, which might allow remote attackers to read cleartext VDI configuration-data requests by sniffing LDAP sessions on the network.

Affected products

• Sun Virtual Desktop Infrastructure: version 3.0 only

Published 2009-08-18. Last modified 2026-06-16.