正文

Device Mapper Device Mapper多路径驱动程序权限许可和访问控制漏洞

admin
admin V管理员 /0 评论 /6 阅读
0105
此篇文章发布距今已超过1229天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Device Mapper Device Mapper多路径驱动程序权限许可和访问控制漏洞

  • CNNVD编号：CNNVD-200903-518
    • <!--
  • 危害等级： 高危-->
  • 危害等级： 高危
  • CVE编号： CVE-2009-0115
  • 漏洞类型： 权限许可和访问控制
  • 发布时间： 2009-03-30
  • 威胁类型： 本地
  • 更新时间： 2009-04-28
  • 厂        商： christophe.varoqui
  • 漏洞来源： SUSE

漏洞简介

Device Mapper multipath-tools软件包是提供工具来管理发出指示设备映射多路径内核模块多路设备，通过建立和删除的设备的分区来实现设备映射。 当在SUSE openSUSE，SUSE Linux Enterprise Server(SLES)，Fedora和其他操作系统中使用时，Device Mapper多路径驱动程序0.4.8版本为套接字文件(又称/var/run/multipathd.sock)使用全局可写权限。本地用户可利用此漏洞发送任意指令到多路径后台程序。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Debian Linux 5.0 ia-64

Debian kpartx_0.4.8-14+lenny1_ia64.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_ia64.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_ia64.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_ia64.deb

Debian multipath-udeb_0.4.8-14+lenny1_ia64.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_ia64.udeb

Debian Linux 4.0 powerpc

Debian multipath-tools_0.4.7-1.1etch2_powerpc.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.7-1.1etch2_powerpc.deb

Debian Linux 5.0 alpha

Debian kpartx_0.4.8-14+lenny1_alpha.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_alpha.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_alpha.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_alpha.deb

Debian multipath-udeb_0.4.8-14+lenny1_alpha.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_alpha.udeb

Debian Linux 5.0 ia-32

Debian kpartx_0.4.8-14+lenny1_i386.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_i386.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_i386.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_i386.deb

Debian multipath-udeb_0.4.8-14+lenny1_i386.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_i386.udeb

Debian Linux 5.0 s/390

Debian kpartx_0.4.8-14+lenny1_s390.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_s390.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_s390.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_s390.deb

Debian multipath-udeb_0.4.8-14+lenny1_s390.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_s390.udeb

Debian Linux 5.0 mipsel

Debian kpartx_0.4.8-14+lenny1_mipsel.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_mipsel.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

Debian multipath-tools_0.4.8-14+lenny1_mipsel.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.8-14+lenny1_mipsel.deb

Debian multipath-udeb_0.4.8-14+lenny1_mipsel.udeb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-udeb_0.4.8-14+lenny1_mipsel.udeb

Debian Linux 4.0 amd64

Debian multipath-tools_0.4.7-1.1etch2_amd64.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.7-1.1etch2_amd64.deb

Debian Linux 4.0 ia-32

Debian multipath-tools_0.4.7-1.1etch2_i386.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools_0.4.7-1.1etch2_i386.deb

Debian Linux 5.0 hppa

Debian kpartx_0.4.8-14+lenny1_hppa.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/kpartx_0.4.8-14+lenny1_hppa.deb

Debian multipath-tools-boot_0.4.8-14+lenny1_all.deb

http://security.debian.org/pool/updates/main/m/multipath-tools/multipath-tools-boot_0.4.8-14+lenny1_all.deb

De

参考网址

来源: FEDORA

名称: FEDORA-2009-3453

链接: https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00236.html

来源: FEDORA

名称: FEDORA-2009-3449

链接: https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00231.html

来源: DEBIAN

名称: DSA-1767

链接: http://www.debian.org/security/2009/dsa-1767

来源: support.avaya.com

链接: http://support.avaya.com/elmodocs2/security/ASA-2009-128.htm

来源: SECUNIA

名称: 34759

链接: http://secunia.com/advisories/34759

来源: SECUNIA

名称: 34710

链接: http://secunia.com/advisories/34710

来源: SECUNIA

名称: 34694

链接: http://secunia.com/advisories/34694

来源: SECUNIA

名称: 34642

链接: http://secunia.com/advisories/34642

来源: SECUNIA

名称: 34418

链接: http://secunia.com/advisories/34418

来源: SUSE

名称: SUSE-SR:2009:008

链接: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

来源: SUSE

名称: SUSE-SR:2009:007

链接: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

来源: MISC

链接: http://launchpad.net/bugs/cve/2009-0115

来源: download.opensuse.org

链接: http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml

受影响实体

  • Christophe.Varoqui Multipath-Tools:0.4.8  
    <!--
    2000-1-1
    -->

补丁

    暂无