CVE-2009-0115

Published: Mar 30, 2009Modified: Apr 23, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.

Affected (19)

Products: Christophe.varoqui: Multipath Tools · Fedoraproject: Fedora · Debian: Debian Linux · +5 more

Show all products

Christophe.varoqui: Multipath Tools · Fedoraproject: Fedora · Debian: Debian Linux · Avaya: Intuity Audix Lx, Message Networking, Messaging Storage Server · Novell: Open Enterprise Server · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server · Juniper: Ctpview

1 product

1 product

1 product

3 products

Messaging Storage Server

Novell

1 product

Open Enterprise Server

Opensuse

1 product

Opensuse

Suse

2 products

Linux Enterprise Desktop

Linux Enterprise Server

Juniper

1 product

Ctpview

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Christophe.varoqui Multipath Tools	Version 0.4.8

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 10
Fedoraproject Fedora	Version 9

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Configuration D

7 vulnerable

Vulnerable Software	Affected Versions
Avaya Intuity Audix Lx	Version 2.0
Avaya Intuity Audix Lx	Version 2.0 sp1
Avaya Intuity Audix Lx	Version 2.0 sp2
Avaya Message Networking	Version 3.1
Avaya Messaging Storage Server	Version 3.0
Avaya Messaging Storage Server	Version 4.0
Avaya Messaging Storage Server	Version 5.0

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Novell Open Enterprise Server	All versions
Opensuse Opensuse	From 10.3 to 11.0
Suse Linux Enterprise Desktop	Version 9
Suse Linux Enterprise Server	Version 10
Suse Linux Enterprise Server	Version 9

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Juniper Ctpview	Before 7.1
Juniper Ctpview	Version 7.1

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (38)

http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml

Source: cve@mitre.org

Broken LinkExploit

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691

Source: cve@mitre.org

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: cve@mitre.org

Third Party Advisory

http://launchpad.net/bugs/cve/2009-0115

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

Source: cve@mitre.org

Mailing List

http://lists.vmware.com/pipermail/security-announce/2010/000082.html

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/34418

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/34642

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/34694

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/34710

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/34759

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/38794

Source: cve@mitre.org

Broken LinkVendor Advisory

http://support.avaya.com/elmodocs2/security/ASA-2009-128.htm

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2009/dsa-1767

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0528

Source: cve@mitre.org

Permissions Required

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9214

Source: cve@mitre.org

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00231.html

Source: cve@mitre.org

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00236.html

Source: cve@mitre.org

Mailing List

http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml