| |||||||||||||||||||
Fedora alert FEDORA-2009-3712 (udev)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-3712 2009-04-16 14:36:46 -------------------------------------------------------------------------------- Name : udev Product : Fedora 9 Version : 124 Release : 4.fc9 URL : http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev... Summary : A userspace implementation of devfs Description : The udev package contains an implementation of devfs in userspace using sysfs and netlink. -------------------------------------------------------------------------------- Update Information: udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality. Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes. It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world- writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185) An integer overflow flaw, potentially leading to heap-based buffer overflow was found in one of the utilities providing functionality of the udev device information interface. An attacker could use this flaw to cause a denial of service, or possibly, to execute arbitrary code by providing a specially-crafted arguments as input to this utility. (CVE-2009-1186) Thanks to Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw. Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically. -------------------------------------------------------------------------------- ChangeLog: * Thu Apr 16 2009 Harald Hoyer <harald@redhat.com> 124-4 - fix for CVE-2009-1186 * Tue Apr 14 2009 Harald Hoyer <harald@redhat.com> 124-3 - fix for CVE-2009-1185 * Wed Aug 6 2008 Harald Hoyer <harald@redhat.com> 124-2 - added patch for cdrom tray close bug (rhbz#453095) - fixed udevadm syntax in start_udev (credits B.J.W. Polman) * Fri Jul 4 2008 Harald Hoyer <harald@redhat.com> 124-1.2 - make block devices 0660 as an interim fix (rhbz#451320) * Tue Jun 17 2008 Harald Hoyer <harald@redhat.com> 124-1.1 - readded udevcontrol, udevtrigger symlinks for Fedora 9, which are needed by live-cd-tools * Thu Jun 12 2008 Harald Hoyer <harald@redhat.com> 124-1 - version 124 - removed udevcontrol, udevtrigger symlinks (use udevadm now) * Tue Jun 3 2008 Jeremy Katz <katzj@redhat.com> - 121-2.20080516git - Add lost F9 change to remove /dev/.udev in start_udev (#442827) * Fri May 16 2008 Harald Hoyer <harald@redhat.com> 121-1.20080516git - version 121 + latest git fixes * Wed May 7 2008 Harald Hoyer <harald@redhat.com> 120-6.20080421git - added input/hp_ilo_mouse symlink -------------------------------------------------------------------------------- References: [ 1 ] Bug #495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages https://bugzilla.redhat.com/show_bug.cgi?id=495051 [ 2 ] Bug #495052 - CVE-2009-1186 udev: Buffer overflow in path encoding routine https://bugzilla.redhat.com/show_bug.cgi?id=495052 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update udev' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann... (Log in to post comments)
|
|||||||||||||||||||