Ken Moffat wrote:
[...]
> There are two vulnerabilities in versions of udev before udev-141.
Thanks very much for the heads up.
> (i.) For all previous versions, netlink messages can be received
> from local users, allowing privilege escalation. CVE-2009-1185
>
> (ii.) There is a potential buffer overflow in the util_path_encode
> function - rated as a denial of service. This function was
> introduced comparatively recently (somewhere between versions 114
> and 124) so it does not apply to older versions. CVE-2009-1186
>
> All users who run udev are recommended to upgrade and reboot.
Why? What I see there shows two vulnerabilities indeed, but perhaps
not for everyone. ISTM that they require a hostile local user, or at
least one with a running local agent. I don't see how my LFS machine
is vulnerable if
no serial cable is connected
no network cable is connected
no PLIP is running or connected
nobody lives in my house who wants to do my machine mischief
I am not expert, so I perhaps am not able to see how the vulnerabilities
listed affect my machine. Could you be more specific about how the
vulnerabilities are subject to exploit? I'd appreciate that very much.
IOW, I'd like to see something which would allow us to evaluate what
our exposure might be.
Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
Oppose globalization and One World Governments like the UN.
This message made from 100% recycled bits.
You have found the bank of Larn.
I speak only for myself, and I am unanimous in that!
--
http://linuxfromscratch.org/mailman/listinfo/lfs-support
FAQ: http://www.linuxfromscratch.org/lfs/faq.html
Unsubscribe: See the above information page
