udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in sudo in file parse.c due to a failure     to properly interpret a system group (%group) in the     sudoers configuration file when handling authorization     decisions for users belonging to that group. A local     attacker can exploit this to gain root privileges via a     crafted sudo command. (CVE-2009-0034)

  - A flaw exists in the redirect implementation in libcurl     that allows arbitrary Location values to be accepted     when CURLOPT_FOLLOWLOCATION is enabled. An attacker     with control of a remote HTTP server can exploit this,     via crafted redirect URLs, to trigger requests to     intranet servers, to read or write arbitrary files, or     to execute arbitrary commands. (CVE-2009-0037)

  - A flaw exists in udev due to a failure to verify that a     NETLINK message originates from the kernel space. A     local attacker can exploit this, via a crafted NETLINK     message, to gain elevated privileges on the root file     system. (CVE-2009-1185)

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1185 udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

  - fix for CVE-2009-1185 (bug #495051)

  - Resolves: rhbz#495055

  - removed zaptel rules (rhbz #294061)

  - fixed segfault for empty lines in passwd (rhbz#413831)

  - added patch for iscsi ids (Daniel Berrange)     (rhbz#427640)

  - added /etc/sysconfig/udev-stw, which makes MODULES     configurable (Jeff Bastian) (rhbz#437979)

  - added ext4 support to vol_id (rhbz#444528)

  - updated dasd_id from dasdinfo of s390-tools-1.6.2     (rhbz#430532)

  - Resolves: rhbz#294061, rhbz#413831, rhbz#427640

  - Resolves: rhbz#437979, rhbz#444528, rhbz#430532

  - scsi_id, retry open on EBUSY (rhbz#450279)

  - Resolves: rhbz#450279

  - set selinux context for .udev dirs and symlinks     (rhbz#442886)

  - fixed rule for hp iLO2 virtual mouse device     (rhbz#429215)

  - Resolves: rhbz#429215, rhbz#442886

  - fixed selinux context setting for symlinks (rhbz#441054)

  - Resolves: rhbz#441054

  - fixed regression bug rhbz#430667 introduced by fix for     rhbz#275441

  - Resolves: rhbz#275441

  - added rule for hp iLO2 virtual mouse device     (rhbz#429215)

  - Resolves: rhbz#429215

  - fix for looping vol_id, because of a malformed passwd     (rhbz#425941)

  - revised fix for tape devices (rhbz#231990)

  - Resolves: rhbz#425941, rhbz#231990

  - moved 'ignore_device' for dm devices to 90-dm.rules     (rhbz#275441)

  - added cciss support (rhbz#250484)

  - support more than 10 nst devices in the persistent rules     (rhbz#231990)

  - extra double check for symlinks improved (rhbz#217917)

  - Resolves: rhbz#217917, rhbz#231990, rhbz#250484,     rhbz#275441

  - do not fail, if EEXIST on symlink (#217917)

  - Resolves: rhbz#217917

  - corrected rules for tape devices (#231990)

  - Resolves: rhbz#231990

  - removed pie link flag from static build flags

  - Resolves: rhbz#233956, rhbz#233307, rhbz#226997,     rhbz#236242

  - Resolves: rhbz#217917, rhbz#231990

  - added RPM_OPT_FLAGS and pie to static build flags

  - Resolves: rhbz#233956, rhbz#233307, rhbz#226997,     rhbz#236242

  - Resolves: rhbz#217917, rhbz#231990

  - do not fail, if EEXIST on mkdir (#217917)

  - configure process numbers dynamically according to CPU     and MEM (#226997)

  - link statically (#236242, #233307)

  - fixed rule for raw1394 (#233956)

  - added persistent device names for tape devices (#231990)

  - Resolves: rhbz#233956, rhbz#233307, rhbz#226997,     rhbz#236242

  - Resolves: rhbz#217917, rhbz#231990

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-0427 advisory.

    - fix for CVE-2009-1185 (bug #495051)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world-writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185)

After installing the update, the udevd daemon will be restarted automatically.

a. Service Console package udev

   A vulnerability in the udev program did not verify whether a NETLINK    message originates from kernel space, which allows local users to    gain privileges by sending a NETLINK message from user space.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1185 to this issue.

   Please see http://kb.vmware.com/kb/1011786 for details.

b. Service Console package sudo

   Service Console package for sudo has been updated to version    sudo-1.6.9p17-3. This fixes the following issue: Sudo versions    1.6.9p17 through 1.6.9p19 do not properly interpret a system group    in the sudoers file during authorization decisions for a user who    belongs to that group, which might allow local users to leverage an    applicable sudoers file and gain root privileges by using a sudo    command.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0034 to this issue.

   Please see http://kb.vmware.com/kb/1011781 for more details

c. Service Console package curl

   Service Console package for curl has been updated to version    curl-7.15.5-2.1.  This fixes the following issue: The redirect    implementation in curl and libcurl 5.11 through 7.19.3, when    CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location    values, which might allow remote HTTP servers to trigger arbitrary    requests to intranet servers, read or overwrite arbitrary files by    using a redirect to a file: URL, or execute arbitrary commands by    using a redirect to an scp: URL.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0037 to this issue.

   Please see http://kb.vmware.com/kb/1011782 for details

Updated udev packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality.
Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes.

It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world-writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185)

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw.

Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically.

This update fixes a local privilege escalation in udev.

  - udev did not check the origin of the netlink messages. A     local attacker could fake device create events and so     gain root privileges. (CVE-2009-1185)

The previous update did not apply the actual patch fixing this problem, as was reported to us by SGI.

Please reboot the machine after installing the update, or run:
/etc/init.d/boot.udev restart

This update fixes a local privilege escalation in udev.

  - udev did not check the origin of the netlink messages. A     local attacker could fake device create events and so     gain root privileges. (CVE-2009-1185)

It also fixes three bugs :

  - Fixup persistent symlinks for tapes. (bnc#446534)

  - Fixup broken ATA compability links. (bnc#447995)

  - Add by-path links for tapes (bnc#478132)

This update fixes a local privilege escalation in udev.

  - udev did not check the origin of the netlink messages. A     local attacker could fake device create events and so     gain root privileges. (CVE-2009-1185)

This update fixes a local privilege escalation in udev.

CVE-2009-1185: udev did not check the origin of the netlink messages.
A local attacker could fake device create events and so gain root privileges.

Security vulnerabilities have been identified and fixed in udev.

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space (CVE-2009-1185).

Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments (CVE-2009-1186).

The updated packages have been patched to prevent this.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality.
Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes. It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world- writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185) An integer overflow flaw, potentially leading to heap-based buffer overflow was found in one of the utilities providing functionality of the udev device information interface. An attacker could use this flaw to cause a denial of service, or possibly, to execute arbitrary code by providing a specially crafted arguments as input to this utility.
(CVE-2009-1186) Thanks to Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw. Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that udev did not correctly validate netlink message senders. A local attacker could send specially crafted messages to udev in order to gain root privileges. (CVE-2009-1185)

Sebastian Krahmer discovered a buffer overflow in the path encoding routines in udev. A local attacker could exploit this to crash udev, leading to a denial of service. (CVE-2009-1186).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200904-18 (udev: Multiple vulnerabilities)

    Sebastian Krahmer of SUSE discovered the following two vulnerabilities:
    udev does not verify the origin of NETLINK messages     properly (CVE-2009-1185).
    A buffer overflow exists in the     util_path_encode() function in lib/libudev-util.c (CVE-2009-1186).
  Impact :

    A local attacker could gain root privileges by sending specially     crafted NETLINK messages to udev or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

New udev packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. The udev packages in Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current contained a local root hole vulnerability:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185 The udev packages in Slackware 12.0, 12.1, 12.2, and -current had an integer overflow which could result in a denial of service:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1186 Note that udev is only used with 2.6 kernels, which are not used by default with Slackware 10.2 and 11.0.

Sebastian Kramer discovered two vulnerabilities in udev, the /dev and hotplug management daemon.

  - CVE-2009-1185     udev does not check the origin of NETLINK messages,     allowing local users to gain root privileges.

  - CVE-2009-1186     udev suffers from a buffer overflow condition in path     encoding, potentially allowing arbitrary code execution.

ID	Name	Product	Family	Severity
89115	VMware ESX Multiple Vulnerabilities (VMSA-2009-0009) (remote check)	Nessus	Misc.	high
79454	OracleVM 2.1 : udev (OVMSA-2009-0006)	Nessus	OracleVM Local Security Checks	high
67842	Oracle Linux 5 : udev (ELSA-2009-0427)	Nessus	Oracle Linux Local Security Checks	critical
60570	Scientific Linux Security Update : udev on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
52011	VMSA-2009-0009 : ESX Service Console updates for udev, sudo, and curl	Nessus	VMware ESX Local Security Checks	high
43742	CentOS 5 : udev (CESA-2009:0427)	Nessus	CentOS Local Security Checks	high
41594	SuSE 10 Security Update : udev (ZYPP Patch Number 6203)	Nessus	SuSE Local Security Checks	high
41593	SuSE 10 Security Update : udev (ZYPP Patch Number 6153)	Nessus	SuSE Local Security Checks	high
41432	SuSE 11 Security Update : udev (SAT Patch Number 766)	Nessus	SuSE Local Security Checks	high
40271	openSUSE Security Update : libudev-devel (libudev-devel-768)	Nessus	SuSE Local Security Checks	high
40050	openSUSE Security Update : libudev-devel (libudev-devel-768)	Nessus	SuSE Local Security Checks	high
38658	Mandriva Linux Security Advisory : udev (MDVSA-2009:103-1)	Nessus	Mandriva Local Security Checks	high
36703	Fedora 10 : udev-127-5.fc10 (2009-3711)	Nessus	Fedora Local Security Checks	high
36530	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : udev vulnerabilities (USN-758-1)	Nessus	Ubuntu Local Security Checks	high
36197	GLSA-200904-18 : udev: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
36186	Slackware 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / current : udev (SSA:2009-111-01)	Nessus	Slackware Local Security Checks	high
36182	openSUSE 10 Security Update : libudev-devel (libudev-devel-6158)	Nessus	SuSE Local Security Checks	high
36177	RHEL 5 : udev (RHSA-2009:0427)	Nessus	Red Hat Local Security Checks	high
36175	Fedora 9 : udev-124-4.fc9 (2009-3712)	Nessus	Fedora Local Security Checks	high
36172	Debian DSA-1772-1 : udev - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2009-1185

critical

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high