Lucene search

K
osvGoogleOSV:DSA-1767-1
HistoryApr 09, 2009 - 12:00 a.m.

multipath-tools - denial of service

2009-04-0900:00:00
Google
osv.dev
4

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

It was discovered that multipathd of multipath-tools, a tool-chain to manage
disk multipath device maps, uses insecure permissions on its unix domain
control socket which enables local attackers to issue commands to multipathd
prevent access to storage devices or corrupt file system data.

For the oldstable distribution (etch), this problem has been fixed in
version 0.4.7-1.1etch2.

For the stable distribution (lenny), this problem has been fixed in
version 0.4.8-14+lenny1.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 0.4.8-15.

We recommend that you upgrade your multipath-tools packages.

CPENameOperatorVersion
multipath-toolseq0.4.8-14

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C