71 lines
2.1 KiB
XML
71 lines
2.1 KiB
XML
|
<?xml version="1.0" encoding="utf-8"?>
|
||
|
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||
|
|
|
||
|
|
<glsa id="201006-10">
|
||
|
|
<title>multipath-tools: World-writeable socket</title>
|
||
|
|
<synopsis>
|
||
|
|
multipath-tools does not set correct permissions on the socket file, making
|
||
|
|
it possible to send arbitrary commands to the multipath daemon for local
|
||
|
|
users.
|
||
|
|
</synopsis>
|
||
|
|
<product type="ebuild">multipath-tools</product>
|
||
|
|
<announced>June 01, 2010</announced>
|
||
|
|
<revised>June 01, 2010: 01</revised>
|
||
|
|
<bug>264564</bug>
|
||
|
|
<access>local</access>
|
||
|
|
<affected>
|
||
|
|
<package name="sys-fs/multipath-tools" auto="yes" arch="*">
|
||
|
|
<unaffected range="ge">0.4.8-r1</unaffected>
|
||
|
|
<vulnerable range="lt">0.4.8-r1</vulnerable>
|
||
|
|
</package>
|
||
|
|
</affected>
|
||
|
|
<background>
|
||
|
|
<p>
|
||
|
|
multipath-tools are used to drive the Device Mapper multipathing
|
||
|
|
driver.
|
||
|
|
</p>
|
||
|
|
</background>
|
||
|
|
<description>
|
||
|
|
<p>
|
||
|
|
multipath-tools uses world-writable permissions for the socket file
|
||
|
|
(/var/run/multipathd.sock).
|
||
|
|
</p>
|
||
|
|
</description>
|
||
|
|
<impact type="normal">
|
||
|
|
<p>
|
||
|
|
Local users could send arbitrary commands to the multipath daemon,
|
||
|
|
causing cluster failures and data loss.
|
||
|
|
</p>
|
||
|
|
</impact>
|
||
|
|
<workaround>
|
||
|
|
<p>
|
||
|
|
chmod o-rwx /var/run/multipath.sock
|
||
|
|
</p>
|
||
|
|
</workaround>
|
||
|
|
<resolution>
|
||
|
|
<p>
|
||
|
|
All multipath-tools users should upgrade to the latest version:
|
||
|
|
</p>
|
||
|
|
<code>
|
||
|
|
# emerge --sync
|
||
|
|
# emerge --ask --oneshot --verbose ">=sys-fs/multipath-tools-0.4.8-r1"</code>
|
||
|
|
<p>
|
||
|
|
NOTE: This is a legacy GLSA. Updates for all affected architectures are
|
||
|
|
available since November 13, 2009. It is likely that your system is
|
||
|
|
already no longer affected by this issue.
|
||
|
|
</p>
|
||
|
|
</resolution>
|
||
|
|
<references>
|
||
|
|
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0115">CVE-2009-0115</uri>
|
||
|
|
</references>
|
||
|
|
<metadata tag="requester" timestamp="Fri, 29 Jan 2010 23:30:44 +0000">
|
||
|
|
craig
|
||
|
|
</metadata>
|
||
|
|
<metadata tag="submitter" timestamp="Fri, 09 Apr 2010 17:36:36 +0000">
|
||
|
|
craig
|
||
|
|
</metadata>
|
||
|
|
<metadata tag="bugReady" timestamp="Tue, 01 Jun 2010 12:41:09 +0000">
|
||
|
|
keytoaster
|
||
|
|
</metadata>
|
||
|
|
</glsa>
|