USN-758-1: udev vulnerabilities

Releases

• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 6.06

Packages

• udev -

Details

Sebastian Krahmer discovered that udev did not correctly validate netlink
message senders. A local attacker could send specially crafted messages
to udev in order to gain root privileges. (CVE-2009-1185)

Sebastian Krahmer discovered a buffer overflow in the path encoding routines
in udev. A local attacker could exploit this to crash udev, leading to a
denial of service. (CVE-2009-1186)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.10

• udev - 124-9ubuntu0.2

Ubuntu 8.04

• udev - 117-8ubuntu0.2

Ubuntu 7.10

• udev - 113-0ubuntu17.2

Ubuntu 6.06

• udev - 079-0ubuntu35.1

After a standard system upgrade you need to reboot your computer to
effect the necessary changes.

References

• CVE-2009-1185
• CVE-2009-1186