CDDL is a FILE based license.
Simply, any file that is CDDL licensed, that you have changed, you are obligated to distribute the changed to THAT FILE.
Let's say a CDDL project is available on the web.
It has files X.java and Y.java.
Your project includes X.java, Y.java (which you changed), and Z.java (your code).
You are obligated to make available Y.java, and to ensure the X.java is available.
Since someone else is already distributing X.java (the original project), you don't have do, the source is already available (just not by you).
You changed Y.java, which was licensed under CDDL and the original project is NOT distributing, so you need to make that available.
Finally, Z.java is your own, unencumbered code, you have no obligation to make the available.
If for some reason the original project went bust and was no longer distributing X.java, you would need to some how ensure that it could still be available to your users.
Finally, by "distribution", you are only obligate to make source code available to those with a binary of the code (i.e. the people you make it available to).
If you publicly distribute your binaries, then that means "everybody". If you only sell it to 10 clients, then just to them, not the entire world.
Edit regarding comment:
Original Software is the software you're using is covered by the CDDL.
Modifications is changes to the ORIGINAL software. This is way they have three categories in that clause: Original Software, Modifications, or a combination of both.
Your obligation is only to changes to the files in the Original Software. As I said, CDDL is file based, there is no "viral" aspect to the CDDL. Simply put, if you change their code, you obligated to release those changes. But there is no obligation to code that is solely your own work and not based on the files of the original.