udev Vulnerability

2Gnu · 04-20-2009, 01:26 PM

As described here, there's a nasty little hole in udev:
http://www.securityfocus.com/bid/34539

From what I've read and people I've spoken to, this vulnerability affects all 2.6 udev distros, not just those listed.

There's an exploit now, so I'm wondering:

1. Is it correct to think that this applies to Slackware?

2. If so, how's the patch coming along?

3. If not, why not?

Thanks.

kentyler · 04-20-2009, 02:19 PM

That's a local exploit which may be an issue if you have local users. I'd think if you change the permissions to exclude local users/groups then it may be a bit more secure. IDK just a guess.

2Gnu · 04-20-2009, 03:25 PM

I understand it's a local vulnerability, but since it allows a local user to gain root privileges, it's not a minor one.

disturbed1 · 04-20-2009, 10:26 PM

Quote:

Originally Posted by 2Gnu

As described here, there's a nasty little hole in udev:
http://www.securityfocus.com/bid/34539

From what I've read and people I've spoken to, this vulnerability affects all 2.6 udev distros, not just those listed.

There's an exploit now, so I'm wondering:

1. Is it correct to think that this applies to Slackware?

2. If so, how's the patch coming along?

3. If not, why not?

Thanks.

http://www.milw0rm.com/exploits/8478

Try running that as a local user. I get permission denied - so maybe it doesn't apply - maybe the above script is flawed. I honestly have no clue.

The CVE is still under Candidate status. Gentoo, Ubuntu, RedHat have already released patches. Udev 141 (Apr - 08) doesn't apply here.
Slackware has 135 for -current and 12.2, 12.1 is using 118.

The openssl fiasco is still fresh in my mind

2Gnu · 04-20-2009, 11:28 PM

Quote:

Originally Posted by disturbed1

Udev 141 (Apr - 08) doesn't apply here.
Slackware has 135 for -current and 12.2, 12.1 is using 118.

That may be the answer. Thanks.

sahko · 04-21-2009, 01:16 AM

Quote:

Originally Posted by Slackware-current ChangeLog

a/udev-141-i486-1.tgz:
Upgraded to udev-141.
Changed serial devices from group 'uucp' to group 'dialout'.
This upgrade fixes a local root hole and a denial of service issue.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename...=CVE-2009-1185
http://cve.mitre.org/cgi-bin/cvename...=CVE-2009-1186
(* Security fix *)

Same for 12.2

mRgOBLIN · 04-21-2009, 01:57 AM

Even better

New udev packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2,
and -current to fix security issues.

http://www.slackware.com/security/vi...ecurity.446399

sahko · 04-21-2009, 04:14 AM

Quote:

Originally Posted by mRgOBLIN

Even better

New udev packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2,
and -current to fix security issues.

http://www.slackware.com/security/vi...ecurity.446399

Yeah thats better, i dont follow security, since following -current makes it somehow obsolete.