Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | device-mapper-multipath security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2009:0411 | First vendor Publication | 2009-04-07 |
| Vendor | RedHat | Last vendor Modification | 2009-04-07 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated device-mapper-multipath packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: The device-mapper multipath packages provide tools to manage multipath devices by issuing instructions to the device-mapper multipath kernel module, and by managing the creation and removal of partitions for device-mapper devices. It was discovered that the multipathd daemon set incorrect permissions on the socket used to communicate with command line clients. An unprivileged, local user could use this flaw to send commands to multipathd, resulting in access disruptions to storage devices accessible via multiple paths and, possibly, file system corruption on these devices. (CVE-2009-0115) Users of device-mapper-multipath are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. The multipathd service must be restarted for the changes to take effect. Important: the version of the multipathd daemon in Red Hat Enterprise Linux 5 has a known issue which may cause a machine to become unresponsive when the multipathd service is stopped. This issue is tracked in the Bugzilla bug #494582; a link is provided in the References section of this erratum. Until this issue is resolved, we recommend restarting the multipathd service by issuing the following commands in sequence: # killall -KILL multipathd # service multipathd restart 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 493330 - CVE-2009-0115 device-mapper-multipath: insecure permissions on multipathd.sock |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2009-0411.html |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-1 | Accessing Functionality Not Properly Constrained by ACLs |
| CAPEC-17 | Accessing, Modifying or Executing Executable Files |
| CAPEC-60 | Reusing Session IDs (aka Session Replay) |
| CAPEC-61 | Session Fixation |
| CAPEC-62 | Cross Site Request Forgery (aka Session Riding) |
| CAPEC-122 | Exploitation of Authorization |
| CAPEC-180 | Exploiting Incorrectly Configured Access Control Security Levels |
| CAPEC-232 | Exploitation of Privilege/Trust |
| CAPEC-234 | Hijacking a privileged process |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-732 | Incorrect Permission Assignment for Critical Resource (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13427 | |||
| Oval ID: | oval:org.mitre.oval:def:13427 | ||
| Title: | DSA-1767-1 multipath-tools -- insecure file permissions | ||
| Description: | It was discovered that multipathd of multipath-tools, a tool-chain to manage disk multipath device maps, uses insecure permissions on its unix domain control socket which enables local attackers to issue commands to multipathd prevent access to storage devices or corrupt file system data. For the oldstable distribution, this problem has been fixed in version 0.4.7-1.1etch2. For the stable distribution, this problem has been fixed in version 0.4.8-14+lenny1. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 0.4.8-15. We recommend that you upgrade your multipath-tools packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1767-1 CVE-2009-0115 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | multipath-tools |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22811 | |||
| Oval ID: | oval:org.mitre.oval:def:22811 | ||
| Title: | ELSA-2009:0411: device-mapper-multipath security update (Moderate) | ||
| Description: | The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:0411-01 CVE-2009-0115 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | device-mapper-multipath |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29387 | |||
| Oval ID: | oval:org.mitre.oval:def:29387 | ||
| Title: | RHSA-2009:0411 -- device-mapper-multipath security update (Moderate) | ||
| Description: | Updated device-mapper-multipath packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The device-mapper multipath packages provide tools to manage multipath devices by issuing instructions to the device-mapper multipath kernel module, and by managing the creation and removal of partitions for device-mapper devices. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:0411 CESA-2009:0411-CentOS 5 CVE-2009-0115 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | device-mapper-multipath |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9214 | |||
| Oval ID: | oval:org.mitre.oval:def:9214 | ||
| Title: | The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon. | ||
| Description: | The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0115 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 | |
| Application | 1 | |
| Application | 3 | |
| Application | 1 | |
| Application | 2 | |
| Os | 2 | |
| Os | 2 | |
| Os | 1 | |
| Os | 4 | |
| Os | 1 | |
| Os | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for device-mapper-multipath CESA-2009:0411 centos4 i386 File : nvt/gb_CESA-2009_0411_device-mapper-multipath_centos4_i386.nasl |
| 2011-08-09 | Name : CentOS Update for device-mapper-multipath CESA-2009:0411 centos5 i386 File : nvt/gb_CESA-2009_0411_device-mapper-multipath_centos5_i386.nasl |
| 2011-03-09 | Name : Gentoo Security Advisory GLSA 201006-10 (multipath-tools) File : nvt/glsa_201006_10.nasl |
| 2009-10-13 | Name : SLES10: Security update for multipath-tools File : nvt/sles10_multipath-tools.nasl |
| 2009-10-10 | Name : SLES9: Security update for multipath-tools File : nvt/sles9p5046186.nasl |
| 2009-04-15 | Name : RedHat Security Advisory RHSA-2009:0411 File : nvt/RHSA_2009_0411.nasl |
| 2009-04-15 | Name : Debian Security Advisory DSA 1767-1 (multipath-tools) File : nvt/deb_1767_1.nasl |
| 2009-04-15 | Name : Fedora Core 10 FEDORA-2009-3449 (device-mapper-multipath) File : nvt/fcore_2009_3449.nasl |
| 2009-04-15 | Name : Fedora Core 9 FEDORA-2009-3453 (device-mapper-multipath) File : nvt/fcore_2009_3453.nasl |
| 2009-04-15 | Name : CentOS Security Advisory CESA-2009:0411 (device-mapper-multipath) File : nvt/ovcesa2009_0411.nasl |
| 2009-04-06 | Name : SuSE Security Summary SUSE-SR:2009:008 File : nvt/suse_sr_2009_008.nasl |
| 2009-03-31 | Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 53486 | multipath-tools in SUSE /var/run/multipathd.sock Multipath Daemon Local Arbit... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2015-07-16 | IAVM : 2015-A-0150 - Multiple Security Vulnerabilities in Juniper Networks CTPView Severity : Category I - VMSKEY : V0061073 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-03-08 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0004_remote.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0411.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090407_device_mapper_multipath_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2010-06-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201006-10.nasl - Type : ACT_GATHER_INFO |
| 2010-03-05 | Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2010-0004.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12377.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_multipath-tools-6083.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_kpartx-090317.nasl - Type : ACT_GATHER_INFO |
| 2009-05-26 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0411.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3449.nasl - Type : ACT_GATHER_INFO |
| 2009-04-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1767.nasl - Type : ACT_GATHER_INFO |
| 2009-04-10 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3453.nasl - Type : ACT_GATHER_INFO |
| 2009-04-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0411.nasl - Type : ACT_GATHER_INFO |
| 2009-03-20 | Name : The remote openSUSE host is missing a security update. File : suse_kpartx-6082.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:52:25 |
|
