CVE-2009-0115: Avaya Intuity Audix Lx

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.

Affected products

• Avaya Intuity Audix Lx: version 2.0 only
• Avaya Message Networking: version 3.1 only
• Avaya Messaging Storage Server: version 3.0 only; version 4.0 only; version 5.0 only
• Christophe.varoqui Multipath-Tools: version 0.4.8 only
• Debian Debian Linux: version 4.0 only; version 5.0 only
• Fedoraproject Fedora: version 9 only; version 10 only
• Juniper Ctpview: before 7.1 (fixed in 7.1); version 7.1 only
• Novell Open Enterprise Server: affected versions not specified
• Opensuse Opensuse: from 10.3, up to and including 11.0
• Suse Linux Enterprise Desktop: version 9 only
• Suse Linux Enterprise Server: version 9 only; version 10 only

Published 2009-03-30. Last modified 2026-06-16.