Bug 493330 (CVE-2009-0115)

Summary: CVE-2009-0115 device-mapper-multipath: insecure permissions on multipathd.sock
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agk, bmarzins, bmr, christophe.varoqui, dwysocha, egoggin, heinzm, iannis, junichi.nomura, kreilly, kueda, lmb, lvm-team, mbroz, msnitzer, ovirt-maint, prockai, tranlan, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0115
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-05-04 17:06:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 493399, 493400, 493401, 493402    
Bug Blocks:    
Attachments:
Description Flags
Patch extracted from SuSE SRPM none

Description Tomas Hoger 2009-04-01 13:32:05 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0115 to the following vulnerability:

multipath-tools in SUSE openSUSE 10.3 through 11.0 and SUSE Linux
Enterprise Server (SLES) 10 uses world-writable permissions for the
socket file (aka /var/run/multipathd.sock), which allows local users
to send arbitrary commands to the multipath daemon. 

References:
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml
http://secunia.com/advisories/34418
Comment 1 Tomas Hoger 2009-04-01 13:33:28 UTC 
Affected component in Red Hat Enterprise Linux / Fedora is device-mapper-multipath, with both EL4 and EL5 seem to be affected by this flaw.
Comment 2 Tomas Hoger 2009-04-01 13:36:50 UTC 
Created attachment 337521 [details]
Patch extracted from SuSE SRPM

Source: http://download.opensuse.org/pub/opensuse/update/10.3/rpm/src/multipath-tools-0.4.7-80.2.src.rpm

The patch does not yet seem to be applied in the upstream git:
http://git.kernel.org/gitweb.cgi?p=linux/storage/multipath-tools/.git;a=tree;f=multipathd
Comment 19 errata-xmlrpc 2009-04-07 19:04:49 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:0411 https://rhn.redhat.com/errata/RHSA-2009-0411.html
Comment 20 Fedora Update System 2009-04-07 20:02:41 UTC 
device-mapper-multipath-0.4.7-17.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/device-mapper-multipath-0.4.7-17.fc9
Comment 21 Fedora Update System 2009-04-07 20:02:47 UTC 
device-mapper-multipath-0.4.8-9.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/device-mapper-multipath-0.4.8-9.fc10
Comment 22 Fedora Update System 2009-04-09 16:09:42 UTC 
device-mapper-multipath-0.4.8-9.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 23 Fedora Update System 2009-04-09 16:10:07 UTC 
device-mapper-multipath-0.4.7-17.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.