Linux爆本地提权漏洞,总结修复办法

关3695

  
  　　目前RH5 和UBANTU 以及DABIAN都测试通过了 但是TURBOLINUX上没有测试通过   
Linux的udev程序再爆本地提权漏洞，本地用户可以轻易获得root权限，请立即更新udev程序。（2.4内核系统不受影响）   
修复方法(修复前请备份重要数据)：   
debian用户请执行apt-get update ; apt-get upgrade -y   
centos用户请执行yum update udev   
RedHat用户请使用官方rpm包更新或者购买RedHat的satellite服务。   
有关rpm包请看：http://rhn.redhat.com/errata/RHSA-2009-0427.html   
攻击效果展示：     
libuuid@debian:~$ sh a 890   
sh-3.1# id   
uid=0(root) gid=0(root) groups=105(libuuid)   
sh-3.1# cat /etc/debian_version   
lenny/sid   
sh-3.1# dpkg -l | grep udev   
ii udev 0.114-2 /dev/ and hotplug management daemon   
现在确认的是此攻击方式对Debian和Ubuntu,RH5相当有效，对rh as 4不受影响。
　　来源于：http://www.zjtbzx.gov.cn/090421/13170.html   
公告ID :RHSA-2009:0427-01   
公告标题:重要：udev安全更新   
厂商 :RedHat   
发布时间:2009-04-16   
更新时间:2009-04-16   
-------------------------------------------------------------------------------   
---------------------------------------------------------------------   
Red Hat安全公告   
概述： 重要：udev安全更新   
公告ID： RHSA-2009:0427-01   
公告URL: https://rhn.redhat.com/errata/RHSA-2009:0427.html   
发布日期： 2009-04-16   
更新日期：
产品： Red Hat Enterprise Linux     
关键词：
参考链接：
被取代公告：
CVE名称： CVE-2009-1185     
---------------------------------------------------------------------   
1 概要：   
现已发布修复一个安全漏洞的Red Hat Enterprise Linux 5的新版udev软件包。   
Red Hat安全响应小组将这个更新归为重要安全影响。   
2 相关发布/架构：   
RHEL Desktop Workstation (v.5客户端) - i386, x86_64   
Red Hat Enterprise Linux (v.5服务器) - i386, ia64, ppc, s390x, x86_64   
Red Hat Enterprise Linux Desktop (v.5客户端) - i386, x86_64   
3 问题描述：   
udev提供用户空间API并在系统中仅存在设备的情况下实现动态设备目录。udev取代了   
devfs以提供更强大的热插拔功能。Netlink是面向数据报的服务，用于在内核模块与   
用户空间进程之间传输信息。   
udev没有正确的检查Netlink消息的来源，本地攻击者可以利用这个漏洞向udev发送特   
制的Netlink消息，导致其创建已有系统块设备（如root文件系统）完全可写的块设备   
文件，以获得root权限。（CVE-2009-1185）   
Red Hat感谢SUSE安全小组的Sebastian Krahmer负责任的报告了这个漏洞。   
建议udev用户升级到这些包含有修复漏洞后端移植补丁的新版软件包。安装更新后，   
udev守护程序会自动重启。   
4 解决办法：   
在应用这个升级之前，确保已经应用了之前所发布的所有系统相关勘误表。   
可从Red Hat Network获得这个更新。有关如何使用Red Hat Network应用此更新的详   
细信息请见http://kbase.redhat.com/faq/docs/DOC-11259 。   
5 已修复Bug（http://bugzilla.redhat.com/ ）：   
495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages   
6 软件包列表：   
Red Hat Enterprise Linux Desktop (v.5客户端):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
RHEL Desktop Workstation (v.5客户端):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
Red Hat Enterprise Linux (v.5服务器):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
ia64:   
libvolume_id-095-14.20.el5_3.ia64.rpm   
libvolume_id-devel-095-14.20.el5_3.ia64.rpm   
udev-095-14.20.el5_3.ia64.rpm   
udev-debuginfo-095-14.20.el5_3.ia64.rpm   
ppc:   
libvolume_id-095-14.20.el5_3.ppc.rpm   
libvolume_id-095-14.20.el5_3.ppc64.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc64.rpm   
udev-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc64.rpm   
s390x:   
libvolume_id-095-14.20.el5_3.s390.rpm   
libvolume_id-095-14.20.el5_3.s390x.rpm   
libvolume_id-devel-095-14.20.el5_3.s390.rpm   
libvolume_id-devel-095-14.20.el5_3.s390x.rpm   
udev-095-14.20.el5_3.s390x.rpm   
udev-debuginfo-095-14.20.el5_3.s390.rpm   
udev-debuginfo-095-14.20.el5_3.s390x.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
出于安全考虑这些软件包都经由Red Hat的GPG签名。密钥和如何验证签名的详细信息   
请见https://www.redhat.com/security/team/key.html#package   
7 参考   
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185   
http://www.redhat.com/security/updates/classification/#important   
8 联系：   
Red Hat安全问题联系是<security>。更多细节请见    <br>http://www.redhat.com/solutions/security/news/contact.html</security>
　　有关centso社区讨论：   
http://www.centos.org/modules/ne ... _id=19794#threadtop   
Red Hat Security Advisory   
Synopsis: Important: udev security update   
Advisory ID: RHSA-2009:0427-01   
Product: Red Hat Enterprise Linux   
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0427.html   
Issue date: 2009-04-16   
CVE Names: CVE-2009-1185   
=====================================================================   
1. Summary:   
Updated udev packages that fix one security issue are now available for Red   
Hat Enterprise Linux 5.   
This update has been rated as having important security impact by the Red   
Hat Security Response Team.   
2. Relevant releases/architectures:   
RHEL Desktop Workstation (v. 5 client) - i386, x86_64   
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64   
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64   
3. Description:   
udev provides a user-space API and implements a dynamic device directory,   
providing only the devices present on the system. udev replaces devfs in   
order to provide greater hot plug functionality. Netlink is a datagram   
oriented service, used to transfer information between kernel modules and   
user-space processes.   
It was discovered that udev did not properly check the origin of Netlink   
messages. A local attacker could use this flaw to gain root privileges via   
a crafted Netlink message sent to udev, causing it to create a   
world-writable block device file for an existing system block device (for   
example, the root file system). (CVE-2009-1185)   
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for   
responsibly reporting this flaw.   
Users of udev are advised to upgrade to these updated packages, which   
contain a backported patch to correct this issue. After installing the   
update, the udevd daemon will be restarted automatically.   
4. Solution:   
Before applying this update, make sure that all previously-released   
errata relevant to your system have been applied.   
This update is available via Red Hat Network. Details on how to use   
the Red Hat Network to apply this update are available at   
http://kbase.redhat.com/faq/docs/DOC-11259   
5. Bugs fixed (http://bugzilla.redhat.com/):   
495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages   
6. Package List:   
Red Hat Enterprise Linux Desktop (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
RHEL Desktop Workstation (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
Red Hat Enterprise Linux (v. 5 server):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
ia64:   
libvolume_id-095-14.20.el5_3.ia64.rpm   
libvolume_id-devel-095-14.20.el5_3.ia64.rpm   
udev-095-14.20.el5_3.ia64.rpm   
udev-debuginfo-095-14.20.el5_3.ia64.rpm   
ppc:   
libvolume_id-095-14.20.el5_3.ppc.rpm   
libvolume_id-095-14.20.el5_3.ppc64.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc64.rpm   
udev-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc64.rpm   
s390x:   
libvolume_id-095-14.20.el5_3.s390.rpm   
libvolume_id-095-14.20.el5_3.s390x.rpm   
libvolume_id-devel-095-14.20.el5_3.s390.rpm   
libvolume_id-devel-095-14.20.el5_3.s390x.rpm   
udev-095-14.20.el5_3.s390x.rpm   
udev-debuginfo-095-14.20.el5_3.s390.rpm   
udev-debuginfo-095-14.20.el5_3.s390x.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
These packages are GPG signed by Red Hat for security. Our key and   
details on how to verify the signature are available from   
https://www.redhat.com/security/team/key/#package   
7. References:   
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185   
http://www.redhat.com/security/updates/classification/#important   
8. Contact:   
The Red Hat security contact is <secalert>. More contact    <br>details at https://www.redhat.com/security/team/contact/    <br>Copyright 2009 Red Hat, Inc.    <br>-----BEGIN PGP SIGNATURE-----    <br>Version: GnuPG v1.4.4 (GNU/Linux)    <br>iD8DBQFJ54p0XlSAg2UNWIIRAhPcAJ92WaPBDHgTirWgXO8esrlNP8RJTwCfdhsX    <br>twaSC4F0wSGZgdg2UEGk704=    <br>=1UHg    <br>-----END PGP SIGNATURE-----</secalert>
　　有关centso社区讨论：   
http://www.centos.org/modules/ne ... _id=19794#threadtop   
Red Hat Security Advisory   
Synopsis: Important: udev security update   
Advisory ID: RHSA-2009:0427-01   
Product: Red Hat Enterprise Linux   
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0427.html   
Issue date: 2009-04-16   
CVE Names: CVE-2009-1185   
=====================================================================   
1. Summary:   
Updated udev packages that fix one security issue are now available for Red   
Hat Enterprise Linux 5.   
This update has been rated as having important security impact by the Red   
Hat Security Response Team.   
2. Relevant releases/architectures:   
RHEL Desktop Workstation (v. 5 client) - i386, x86_64   
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64   
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64   
3. Description:   
udev provides a user-space API and implements a dynamic device directory,   
providing only the devices present on the system. udev replaces devfs in   
order to provide greater hot plug functionality. Netlink is a datagram   
oriented service, used to transfer information between kernel modules and   
user-space processes.   
It was discovered that udev did not properly check the origin of Netlink   
messages. A local attacker could use this flaw to gain root privileges via   
a crafted Netlink message sent to udev, causing it to create a   
world-writable block device file for an existing system block device (for   
example, the root file system). (CVE-2009-1185)   
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for   
responsibly reporting this flaw.   
Users of udev are advised to upgrade to these updated packages, which   
contain a backported patch to correct this issue. After installing the   
update, the udevd daemon will be restarted automatically.   
4. Solution:   
Before applying this update, make sure that all previously-released   
errata relevant to your system have been applied.   
This update is available via Red Hat Network. Details on how to use   
the Red Hat Network to apply this update are available at   
http://kbase.redhat.com/faq/docs/DOC-11259   
5. Bugs fixed (http://bugzilla.redhat.com/):   
495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages   
6. Package List:   
Red Hat Enterprise Linux Desktop (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
RHEL Desktop Workstation (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
Red Hat Enterprise Linux (v. 5 server):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
ia64:   
libvolume_id-095-14.20.el5_3.ia64.rpm   
libvolume_id-devel-095-14.20.el5_3.ia64.rpm   
udev-095-14.20.el5_3.ia64.rpm   
udev-debuginfo-095-14.20.el5_3.ia64.rpm   
ppc:   
libvolume_id-095-14.20.el5_3.ppc.rpm   
libvolume_id-095-14.20.el5_3.ppc64.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc64.rpm   
udev-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc64.rpm   
s390x:   
libvolume_id-095-14.20.el5_3.s390.rpm   
libvolume_id-095-14.20.el5_3.s390x.rpm   
libvolume_id-devel-095-14.20.el5_3.s390.rpm   
libvolume_id-devel-095-14.20.el5_3.s390x.rpm   
udev-095-14.20.el5_3.s390x.rpm   
udev-debuginfo-095-14.20.el5_3.s390.rpm   
udev-debuginfo-095-14.20.el5_3.s390x.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
These packages are GPG signed by Red Hat for security. Our key and   
details on how to verify the signature are available from   
https://www.redhat.com/security/team/key/#package   
7. References:   
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185   
http://www.redhat.com/security/updates/classification/#important   
8. Contact:   
The Red Hat security contact is <secalert>. More contact    <br>details at https://www.redhat.com/security/team/contact/    <br>Copyright 2009 Red Hat, Inc.    <br>-----BEGIN PGP SIGNATURE-----    <br>Version: GnuPG v1.4.4 (GNU/Linux)    <br>iD8DBQFJ54p0XlSAg2UNWIIRAhPcAJ92WaPBDHgTirWgXO8esrlNP8RJTwCfdhsX    <br>twaSC4F0wSGZgdg2UEGk704=    <br>=1UHg    <br>-----END PGP SIGNATURE-----</secalert>
　　漏洞利用代码:
   
Linux提权漏洞代码.zip
　　有关centso社区讨论：   
http://www.centos.org/modules/ne ... _id=19794#threadtop   
Red Hat Security Advisory   
Synopsis: Important: udev security update   
Advisory ID: RHSA-2009:0427-01   
Product: Red Hat Enterprise Linux   
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0427.html   
Issue date: 2009-04-16   
CVE Names: CVE-2009-1185   
=====================================================================   
1. Summary:   
Updated udev packages that fix one security issue are now available for Red   
Hat Enterprise Linux 5.   
This update has been rated as having important security impact by the Red   
Hat Security Response Team.   
2. Relevant releases/architectures:   
RHEL Desktop Workstation (v. 5 client) - i386, x86_64   
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64   
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64   
3. Description:   
udev provides a user-space API and implements a dynamic device directory,   
providing only the devices present on the system. udev replaces devfs in   
order to provide greater hot plug functionality. Netlink is a datagram   
oriented service, used to transfer information between kernel modules and   
user-space processes.   
It was discovered that udev did not properly check the origin of Netlink   
messages. A local attacker could use this flaw to gain root privileges via   
a crafted Netlink message sent to udev, causing it to create a   
world-writable block device file for an existing system block device (for   
example, the root file system). (CVE-2009-1185)   
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for   
responsibly reporting this flaw.   
Users of udev are advised to upgrade to these updated packages, which   
contain a backported patch to correct this issue. After installing the   
update, the udevd daemon will be restarted automatically.   
4. Solution:   
Before applying this update, make sure that all previously-released   
errata relevant to your system have been applied.   
This update is available via Red Hat Network. Details on how to use   
the Red Hat Network to apply this update are available at   
http://kbase.redhat.com/faq/docs/DOC-11259   
5. Bugs fixed (http://bugzilla.redhat.com/):   
495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages   
6. Package List:   
Red Hat Enterprise Linux Desktop (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
RHEL Desktop Workstation (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
Red Hat Enterprise Linux (v. 5 server):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
ia64:   
libvolume_id-095-14.20.el5_3.ia64.rpm   
libvolume_id-devel-095-14.20.el5_3.ia64.rpm   
udev-095-14.20.el5_3.ia64.rpm   
udev-debuginfo-095-14.20.el5_3.ia64.rpm   
ppc:   
libvolume_id-095-14.20.el5_3.ppc.rpm   
libvolume_id-095-14.20.el5_3.ppc64.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc64.rpm   
udev-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc64.rpm   
s390x:   
libvolume_id-095-14.20.el5_3.s390.rpm   
libvolume_id-095-14.20.el5_3.s390x.rpm   
libvolume_id-devel-095-14.20.el5_3.s390.rpm   
libvolume_id-devel-095-14.20.el5_3.s390x.rpm   
udev-095-14.20.el5_3.s390x.rpm   
udev-debuginfo-095-14.20.el5_3.s390.rpm   
udev-debuginfo-095-14.20.el5_3.s390x.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
These packages are GPG signed by Red Hat for security. Our key and   
details on how to verify the signature are available from   
https://www.redhat.com/security/team/key/#package   
7. References:   
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185   
http://www.redhat.com/security/updates/classification/#important   
8. Contact:   
The Red Hat security contact is <secalert>. More contact    <br>details at https://www.redhat.com/security/team/contact/    <br>Copyright 2009 Red Hat, Inc.    <br>-----BEGIN PGP SIGNATURE-----    <br>Version: GnuPG v1.4.4 (GNU/Linux)    <br>iD8DBQFJ54p0XlSAg2UNWIIRAhPcAJ92WaPBDHgTirWgXO8esrlNP8RJTwCfdhsX    <br>twaSC4F0wSGZgdg2UEGk704=    <br>=1UHg    <br>-----END PGP SIGNATURE-----</secalert>
　　有关centso社区讨论：   
http://www.centos.org/modules/ne ... _id=19794#threadtop   
Red Hat Security Advisory   
Synopsis: Important: udev security update   
Advisory ID: RHSA-2009:0427-01   
Product: Red Hat Enterprise Linux   
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0427.html   
Issue date: 2009-04-16   
CVE Names: CVE-2009-1185   
=====================================================================   
1. Summary:   
Updated udev packages that fix one security issue are now available for Red   
Hat Enterprise Linux 5.   
This update has been rated as having important security impact by the Red   
Hat Security Response Team.   
2. Relevant releases/architectures:   
RHEL Desktop Workstation (v. 5 client) - i386, x86_64   
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64   
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64   
3. Description:   
udev provides a user-space API and implements a dynamic device directory,   
providing only the devices present on the system. udev replaces devfs in   
order to provide greater hot plug functionality. Netlink is a datagram   
oriented service, used to transfer information between kernel modules and   
user-space processes.   
It was discovered that udev did not properly check the origin of Netlink   
messages. A local attacker could use this flaw to gain root privileges via   
a crafted Netlink message sent to udev, causing it to create a   
world-writable block device file for an existing system block device (for   
example, the root file system). (CVE-2009-1185)   
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for   
responsibly reporting this flaw.   
Users of udev are advised to upgrade to these updated packages, which   
contain a backported patch to correct this issue. After installing the   
update, the udevd daemon will be restarted automatically.   
4. Solution:   
Before applying this update, make sure that all previously-released   
errata relevant to your system have been applied.   
This update is available via Red Hat Network. Details on how to use   
the Red Hat Network to apply this update are available at   
http://kbase.redhat.com/faq/docs/DOC-11259   
5. Bugs fixed (http://bugzilla.redhat.com/):   
495051 - CVE-2009-1185 udev: Uncheck origin of NETLINK messages   
6. Package List:   
Red Hat Enterprise Linux Desktop (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
RHEL Desktop Workstation (v. 5 client):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
x86_64:   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
Red Hat Enterprise Linux (v. 5 server):   
Source:   
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/udev-095-14.20.el5_3.src.rpm   
i386:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
udev-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
ia64:   
libvolume_id-095-14.20.el5_3.ia64.rpm   
libvolume_id-devel-095-14.20.el5_3.ia64.rpm   
udev-095-14.20.el5_3.ia64.rpm   
udev-debuginfo-095-14.20.el5_3.ia64.rpm   
ppc:   
libvolume_id-095-14.20.el5_3.ppc.rpm   
libvolume_id-095-14.20.el5_3.ppc64.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc.rpm   
libvolume_id-devel-095-14.20.el5_3.ppc64.rpm   
udev-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc.rpm   
udev-debuginfo-095-14.20.el5_3.ppc64.rpm   
s390x:   
libvolume_id-095-14.20.el5_3.s390.rpm   
libvolume_id-095-14.20.el5_3.s390x.rpm   
libvolume_id-devel-095-14.20.el5_3.s390.rpm   
libvolume_id-devel-095-14.20.el5_3.s390x.rpm   
udev-095-14.20.el5_3.s390x.rpm   
udev-debuginfo-095-14.20.el5_3.s390.rpm   
udev-debuginfo-095-14.20.el5_3.s390x.rpm   
x86_64:   
libvolume_id-095-14.20.el5_3.i386.rpm   
libvolume_id-095-14.20.el5_3.x86_64.rpm   
libvolume_id-devel-095-14.20.el5_3.i386.rpm   
libvolume_id-devel-095-14.20.el5_3.x86_64.rpm   
udev-095-14.20.el5_3.x86_64.rpm   
udev-debuginfo-095-14.20.el5_3.i386.rpm   
udev-debuginfo-095-14.20.el5_3.x86_64.rpm   
These packages are GPG signed by Red Hat for security. Our key and   
details on how to verify the signature are available from   
https://www.redhat.com/security/team/key/#package   
7. References:   
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185   
http://www.redhat.com/security/updates/classification/#important   
8. Contact:   
The Red Hat security contact is <secalert>. More contact    <br>details at https://www.redhat.com/security/team/contact/    <br>Copyright 2009 Red Hat, Inc.    <br>-----BEGIN PGP SIGNATURE-----    <br>Version: GnuPG v1.4.4 (GNU/Linux)    <br>iD8DBQFJ54p0XlSAg2UNWIIRAhPcAJ92WaPBDHgTirWgXO8esrlNP8RJTwCfdhsX    <br>twaSC4F0wSGZgdg2UEGk704=    <br>=1UHg    <br>-----END PGP SIGNATURE-----</secalert>