CVE-2009-0115
High
Description
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Christophe.varoqui Multipath-tools
PublishedMar 30, 2009
First seenMar 30, 2009
How to fix
Update
- juniper ctpview7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| christophe.varoqui multipath-tools | 0.4.8 | — |
| fedoraproject fedora | 9, 10 | — |
| debian debian_linux | 4.0, 5.0 | — |
| avaya intuity_audix_lx | 2.0 | — |
| avaya message_networking | 3.1 | — |
| avaya messaging_storage_server | 3.0, 4.0, 5.0 | — |
| novell open_enterprise_server | No range specified | — |
| opensuse opensuse | 10.3 ≤ v ≤ 11.0 | — |
| suse linux_enterprise_desktop | 9 | — |
| suse linux_enterprise_server | 9, 10 | — |
| juniper ctpview | v < 7.1, 7.1 | 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.