| |||||||||||||||||||
Fedora alert FEDORA-2009-3711 (udev)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-3711 2009-04-16 14:36:46 -------------------------------------------------------------------------------- Name : udev Product : Fedora 10 Version : 127 Release : 5.fc10 URL : http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev... Summary : A userspace implementation of devfs Description : The udev package contains an implementation of devfs in userspace using sysfs and netlink. -------------------------------------------------------------------------------- Update Information: udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality. Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes. It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world- writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185) An integer overflow flaw, potentially leading to heap-based buffer overflow was found in one of the utilities providing functionality of the udev device information interface. An attacker could use this flaw to cause a denial of service, or possibly, to execute arbitrary code by providing a specially-crafted arguments as input to this utility. (CVE-2009-1186) Thanks to Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw. Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically. -------------------------------------------------------------------------------- ChangeLog: * Thu Apr 16 2009 Harald Hoyer <harald@redhat.com> 127-5 - fix for CVE-2009-1186 * Wed Apr 15 2009 Harald Hoyer <harald@redhat.com> 127-4 - fix for CVE-2009-1185 -------------------------------------------------------------------------------- References: [ 1 ] Bug #495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages https://bugzilla.redhat.com/show_bug.cgi?id=495051 [ 2 ] Bug #495052 - CVE-2009-1186 udev: Buffer overflow in path encoding routine https://bugzilla.redhat.com/show_bug.cgi?id=495052 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update udev' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann... (Log in to post comments)
|
|||||||||||||||||||