Support / Security / Advisories / Corporate Server 4.0 / MDVSA-2009:104

Package name: udev
Date: 2009-04-30
Advisory ID: MDVSA-2009:104
Affected versions: CS4.0 x86_64 , CS4.0 i586

Problem description

udev before 1.4.1 does not verify whether a NETLINK message originates
from kernel space, which allows local users to gain privileges by
sending a NETLINK message from user space (CVE-2009-1185).

The updated packages have been patched to prevent this.

Updated packages

CS4.0 x86_64

 fe676d2bc1399ea76e2919aa5755f8b5  corporate/4.0/x86_64/udev-068-34.1.20060mlcs4.x86_64.rpm
 0a88b5f9caf0e6b910b9f465b0b5da3e  corporate/4.0/x86_64/udev-doc-068-34.1.20060mlcs4.x86_64.rpm
 f3aecddcf2ef8347e39b376597d85b12  corporate/4.0/x86_64/udev-tools-068-34.1.20060mlcs4.x86_64.rpm 
 27b02f6eb22dd35104585c56c527da28  corporate/4.0/SRPMS/udev-068-34.1.20060mlcs4.src.rpm

CS4.0 i586

 3a371eee121816d9c4a82c4950741519  corporate/4.0/i586/udev-068-34.1.20060mlcs4.i586.rpm
 bb856a7f9a87741176990a18184c3068  corporate/4.0/i586/udev-doc-068-34.1.20060mlcs4.i586.rpm
 ba1d8692dc6efd1d7875487bb339332f  corporate/4.0/i586/udev-tools-068-34.1.20060mlcs4.i586.rpm 
 27b02f6eb22dd35104585c56c527da28  corporate/4.0/SRPMS/udev-068-34.1.20060mlcs4.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185