CVE-2009-1093 Denial of service in n/a
Remote attackers can cause a denial of service in the Java LDAP service by triggering initialization failures that leave connections open.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-1093?
CVE-2009-1093 is a medium-severity denial of service vulnerability in Sun Jdk, published on 25 Mar 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
Weakness: CWE-16
Which versions are affected by CVE-2009-1093?
It affects 3 products.
How do I fix CVE-2009-1093?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2009-1093 being exploited?
There is no known exploitation of CVE-2009-1093 in the wild and no public exploit code.
Other vulnerabilities in Sun Jdk
Sources
Also known as GHSA-4qmv-gqgr-jxhq.