Detections
Analytics
CentOS 5 : udev (CESA-2009:0427)
high Nessus Plugin ID 43742
Language:
Synopsis
The remote CentOS host is missing one or more security updates.Description
Updated udev packages that fix one security issue are now available for Red Hat Enterprise Linux 5.This update has been rated as having important security impact by the Red Hat Security Response Team.
udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality.
Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes.
It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world-writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185)
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw.
Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically.
Solution
Update the affected udev packages.See Also
Plugin Details
Severity: High
ID: 43742
File Name: centos_RHSA-2009-0427.nasl
Version: 1.19
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 1/6/2010
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 10.0
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:centos:centos:libvolume_id, cpe:/o:centos:centos:5, p-cpe:/a:centos:centos:udev, p-cpe:/a:centos:centos:libvolume_id-devel
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/20/2009
Vulnerability Publication Date: 4/17/2009
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Linux udev Netlink Local Privilege Escalation)
Reference Information
CVE: CVE-2009-1185
BID: 34536