Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.

Security vulnerabilities have been identified and fixed in udev.

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space (CVE-2009-1185).

Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments (CVE-2009-1186).

The updated packages have been patched to prevent this.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality.
Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes. It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world- writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185) An integer overflow flaw, potentially leading to heap-based buffer overflow was found in one of the utilities providing functionality of the udev device information interface. An attacker could use this flaw to cause a denial of service, or possibly, to execute arbitrary code by providing a specially crafted arguments as input to this utility.
(CVE-2009-1186) Thanks to Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw. Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that udev did not correctly validate netlink message senders. A local attacker could send specially crafted messages to udev in order to gain root privileges. (CVE-2009-1185)

Sebastian Krahmer discovered a buffer overflow in the path encoding routines in udev. A local attacker could exploit this to crash udev, leading to a denial of service. (CVE-2009-1186).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200904-18 (udev: Multiple vulnerabilities)

    Sebastian Krahmer of SUSE discovered the following two vulnerabilities:
    udev does not verify the origin of NETLINK messages     properly (CVE-2009-1185).
    A buffer overflow exists in the     util_path_encode() function in lib/libudev-util.c (CVE-2009-1186).
  Impact :

    A local attacker could gain root privileges by sending specially     crafted NETLINK messages to udev or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

New udev packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. The udev packages in Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current contained a local root hole vulnerability:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185 The udev packages in Slackware 12.0, 12.1, 12.2, and -current had an integer overflow which could result in a denial of service:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1186 Note that udev is only used with 2.6 kernels, which are not used by default with Slackware 10.2 and 11.0.

Sebastian Kramer discovered two vulnerabilities in udev, the /dev and hotplug management daemon.

  - CVE-2009-1185     udev does not check the origin of NETLINK messages,     allowing local users to gain root privileges.

  - CVE-2009-1186     udev suffers from a buffer overflow condition in path     encoding, potentially allowing arbitrary code execution.

ID	Name	Product	Family	Severity
38658	Mandriva Linux Security Advisory : udev (MDVSA-2009:103-1)	Nessus	Mandriva Local Security Checks	high
36703	Fedora 10 : udev-127-5.fc10 (2009-3711)	Nessus	Fedora Local Security Checks	high
36530	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : udev vulnerabilities (USN-758-1)	Nessus	Ubuntu Local Security Checks	high
36197	GLSA-200904-18 : udev: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
36186	Slackware 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / current : udev (SSA:2009-111-01)	Nessus	Slackware Local Security Checks	high
36175	Fedora 9 : udev-124-4.fc9 (2009-3712)	Nessus	Fedora Local Security Checks	high
36172	Debian DSA-1772-1 : udev - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2009-1186

medium

Tenable Plugins

high

high

high

high

high

high

high