CVE-2009-4440
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6...
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593.
Exploit likelihood
What each source reports
NVD Score used
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593.
- Record
CVE-2009-4440- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593.
- Record
CVE-2009-4440- Updated
- 2026-11-02
EUVDEUVD-2009-4407 No score
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593.
- Record
EUVD-2009-4407- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwc8-mq5g-v7jf No score
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6...
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593.
- Record
GHSA-pwc8-mq5g-v7jf- Weakness
- CWE-362
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4440 is a medium vulnerability (CVSS 6.8) in Sun Java System Directory Server, published December 28, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 76th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2009/3647
sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1
securityfocus.com/bid/37481
securitytracker.com/id?1023389
secunia.com/advisories/37915
nvd.nist.gov/vuln/detail/CVE-2009-4440
github.com/advisories/GHSA-pwc8-mq5g-v7jf