Strix
26.1K

CVE-2009-1093

UnknownEPSS 3.89%

Last modified

CVE-2009-1093 is a vulnerability of currently unknown severity. LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).. EPSS estimates a 3.89% chance of exploitation in the next 30 days.

Description

LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).

Metrics

EPSS Probability
3.89%

88.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
SunJdk<= 1.5.0Update17
SunJdk<= 1.6.0Update 12
SunJdk1.5.0—
SunJdk1.6.0Update 10
SunJre<= 1.5.0Update17
SunJre<= 1.6.0Update 12
SunJre1.5.0—
SunJre1.6.0—
SunJre<= 1.3.1_24—
SunJre1.3.1—
SunJre1.3.1_01—
SunJre1.3.1_2—
SunJre1.3.1_03—
SunJre1.3.1_04—
SunJre1.3.1_05—
SunJre1.3.1_06—
SunJre1.3.1_07—
SunJre1.3.1_08—
SunJre1.3.1_09—
SunJre1.3.1_10—
SunJre1.3.1_11—
SunJre1.3.1_12—
SunJre1.3.1_13—
SunJre1.3.1_14—
SunJre1.3.1_15—
SunJre1.3.1_16—
SunJre1.3.1_17—
SunJre1.3.1_18—
SunJre1.3.1_19—
SunJre1.3.1_20—
SunJre1.3.1_21—
SunJre1.3.1_22—
SunJre1.3.1_23—
SunSdk<= 1.3.1_24—
SunSdk1.3.1—
SunSdk1.3.1_01—
SunSdk1.3.1_01a—
SunSdk1.3.1_02—
SunSdk1.3.1_03—
SunSdk1.3.1_04—
SunSdk1.3.1_05—
SunSdk1.3.1_06—
SunSdk1.3.1_07—
SunSdk1.3.1_08—
SunSdk1.3.1_09—
SunSdk1.3.1_10—
SunSdk1.3.1_11—
SunSdk1.3.1_12—
SunSdk1.3.1_13—
SunSdk1.3.1_14—

Showing 50 of 102 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2009-1093?
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
How severe is CVE-2009-1093?
Severity scoring for CVE-2009-1093 is pending analysis. The EPSS model estimates a 3.89% probability of exploitation in the next 30 days.
How do I fix CVE-2009-1093?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-1093?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST