multipath-tools does not set correct permissions on the socket file, making it possible to send arbitrary commands to the multipath daemon for local users.
|Package||sys-fs/multipath-tools on all architectures|
|Affected versions||< 0.4.8-r1|
|Unaffected versions||>= 0.4.8-r1|
multipath-tools are used to drive the Device Mapper multipathing driver.
multipath-tools uses world-writable permissions for the socket file (/var/run/multipathd.sock).
Local users could send arbitrary commands to the multipath daemon, causing cluster failures and data loss.
chmod o-rwx /var/run/multipath.sock
All multipath-tools users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/multipath-tools-0.4.8-r1"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since November 13, 2009. It is likely that your system is already no longer affected by this issue.
June 01, 2010
June 01, 2010: 01