Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-0115

The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.

Published

2009-03-30T16:30:00.343

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application christophe.varoqui multipath-tools 0.4.8 Yes
Operating System fedoraproject fedora 9 Yes
Operating System fedoraproject fedora 10 Yes
Operating System debian debian_linux 4.0 Yes
Operating System debian debian_linux 5.0 Yes
Application avaya intuity_audix_lx 2.0 Yes
Application avaya intuity_audix_lx 2.0 Yes
Application avaya intuity_audix_lx 2.0 Yes
Application avaya message_networking 3.1 Yes
Application avaya messaging_storage_server 3.0 Yes
Application avaya messaging_storage_server 4.0 Yes
Application avaya messaging_storage_server 5.0 Yes
Operating System novell open_enterprise_server - Yes
Operating System opensuse opensuse ≤ 11.0 Yes
Operating System suse linux_enterprise_desktop 9 Yes
Operating System suse linux_enterprise_server 9 Yes
Operating System suse linux_enterprise_server 10 Yes
Application juniper ctpview < 7.1 Yes
Application juniper ctpview 7.1 Yes
References