CVE-2009-0115
Fixed in a distro release EPSS <1%
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.
Products: christophe.varoqui multipath-tools, fedoraproject fedora, debian_linux, avaya intuity_audix_lx, avaya message_networking, avaya messaging_storage_server, novell open_enterprise_server, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_server, juniper ctpview
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | multipath-tools | 0.4.8-15 |
| Debian 13 | multipath-tools | 0.4.8-15 |
| Debian 14 | multipath-tools | 0.4.8-15 |
| Debian 4.0 | multipath-tools | 0.4.7-1.1etch2 |
| Debian 5.0 | multipath-tools | 0.4.8-14+lenny1 |
| Red Hat Enterprise Linux 4 | device-mapper-multipath | 0:0.4.5-31.el4_7.1 |
| Red Hat Enterprise Linux 4 | device-mapper-multipath-debuginfo | 0:0.4.5-31.el4_7.1 |
| Red Hat Enterprise Linux 5 | device-mapper-multipath | 0:0.4.7-23.el5_3.2 |
| Red Hat Enterprise Linux 5 | device-mapper-multipath-debuginfo | 0:0.4.7-23.el5_3.2 |
| Red Hat Enterprise Linux 5 | kpartx | 0:0.4.7-23.el5_3.2 |