CVE-2009-4440: Sun Java System Directory Server

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593.

Affected products

• Sun Java System Directory Server: version 6.0 only; version 6.1 only; version 6.2 only; version 6.3 only

Published 2009-12-28. Last modified 2026-06-16.