Device Mapper Device Mapper多路径驱动程序权限许可和访问控制漏洞

CNNVD-ID编号	CNNVD-200903-518
CVE编号	CVE-2009-0115
发布时间	2009-03-30
更新时间	2009-04-28
漏洞类型	权限许可和访问控制
漏洞来源	N/A
危险等级	高危
威胁类型	本地
厂商	christophe.varoqui

漏洞介绍

Device Mapper multipath-tools软件包是提供工具来管理发出指示设备映射多路径内核模块多路设备，通过建立和删除的设备的分区来实现设备映射。当在SUSE openSUSE，SUSE Linux Enterprise Server(SLES)，Fedora和其他操作系统中使用时，Device Mapper多路径驱动程序0.4.8版本为套接字文件(又称/var/run/multipathd.sock)使用全局可写权限。本地用户可利用此漏洞发送任意指令到多路径后台程序。

漏洞补丁

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Debian Linux 5.0 ia-64

Debian kpartx_0.4.8-14+lenny1_ia64.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_ia64.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_ia64.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_ia64.deb

Debian multipath-udeb_0.4.8-14+lenny1_ia64.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_ia64.udeb

Debian Linux 4.0 powerpc

Debian multipath-tools_0.4.7-1.1etch2_powerpc.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.7-1.1etch2_powerpc.deb

Debian Linux 5.0 alpha

Debian kpartx_0.4.8-14+lenny1_alpha.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_alpha.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_alpha.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_alpha.deb

Debian multipath-udeb_0.4.8-14+lenny1_alpha.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_alpha.udeb

Debian Linux 5.0 ia-32

Debian kpartx_0.4.8-14+lenny1_i386.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_i386.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_i386.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_i386.deb

Debian multipath-udeb_0.4.8-14+lenny1_i386.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_i386.udeb

Debian Linux 5.0 s/390

Debian kpartx_0.4.8-14+lenny1_s390.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_s390.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_s390.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_s390.deb

Debian multipath-udeb_0.4.8-14+lenny1_s390.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_s390.udeb

Debian Linux 5.0 mipsel

Debian kpartx_0.4.8-14+lenny1_mipsel.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_mipsel.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_mipsel.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_mipsel.deb

Debian multipath-udeb_0.4.8-14+lenny1_mipsel.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_mipsel.udeb

Debian Linux 4.0 amd64

Debian multipath-tools_0.4.7-1.1etch2_amd64.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.7-1.1etch2_amd64.deb

Debian Linux 4.0 ia-32

Debian multipath-tools_0.4.7-1.1etch2_i386.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.7-1.1etch2_i386.deb

Debian Linux 5.0 hppa

Debian kpartx_0.4.8-14+lenny1_hppa.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_hppa.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

参考网址

来源: FEDORA

名称: FEDORA-2009-3453

链接：https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00236.html
来源: FEDORA

名称: FEDORA-2009-3449

链接：https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00231.html
来源: DEBIAN

名称: DSA-1767

链接：http://www.debian.org/security/2009/dsa-1767
来源: support.avaya.com

链接：http://support.avaya.com/elmodocs2/security/ASA-2009-128.htm
来源: SECUNIA

名称: 34759

链接：http://secunia.com/advisories/34759
来源: SECUNIA

名称: 34710

链接：http://secunia.com/advisories/34710
来源: SECUNIA

名称: 34694

链接：http://secunia.com/advisories/34694
来源: SECUNIA

名称: 34642

链接：http://secunia.com/advisories/34642
来源: SECUNIA

名称: 34418

链接：http://secunia.com/advisories/34418
来源: SUSE

名称: SUSE-SR:2009:008

链接：http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
来源: SUSE

名称: SUSE-SR:2009:007

链接：http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
来源: MISC

链接：http://launchpad.net/bugs/cve/2009-0115

受影响实体

Christophe.Varoqui Multipath-Tools:0.4.8

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-518