CVE-2009-3939: avaya aura_application_enablement_services
Vulnerability summary
CVE-2009-3939 is a high (CVSS 7.1) vulnerability in avaya aura_application_enablement_services. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 16-11-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.44% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Avaya7 products
- aura_application_enablement_services5.2 | 5.2.1
- aura_communication_manager5.2
- aura_session_manager1.1 | 5.2
- aura_sip_enablement_services5.2
- aura_system_manager5.2 | 6.0
Redhat5 products
Suse2 products
- linux_enterprise_desktop10:sp3 | 11
- linux_enterprise_server10:sp3 | 11
Canonical1 product
- ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04 | 9.10
Debian1 product
- debian_linuxEOL5.0
Linux1 product
- linux_kernel≤ 2.6.31.6
Opensuse1 product
- opensuseEOL11.0 | 11.1 | 11.2
7 vendors · 18 products
References
23 links- lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing List
Show all 23 references
- lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing List
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10310VDB EntrySignatureX Refsource OVALBroken Link
- lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing List
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7540VDB EntrySignatureX Refsource OVALBroken Link
- lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing List