The remote host is missing an update to udev announced via advisory FEDORA-2009-3711.

Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update udev' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-3711

The udev package contains an implementation of devfs in userspace using sysfs and netlink. Update Information: udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality. Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes. It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world- writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185) An integer overflow flaw, potentially leading to heap-based buffer overflow was found in one of the utilities providing functionality of the udev device information interface. An attacker could use this flaw to cause a denial of service, or possibly, to execute arbitrary code by providing a specially-crafted arguments as input to this utility. (CVE-2009-1186) Thanks to Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw. Users of udev are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the udevd daemon will be restarted automatically. ChangeLog: * Thu Apr 16 2009 Harald Hoyer 127-5 - fix for CVE-2009-1186 * Wed Apr 15 2009 Harald Hoyer 127-4 - fix for CVE-2009-1185

• https://bugzilla.redhat.com/show_bug.cgi?id=495051
• https://bugzilla.redhat.com/show_bug.cgi?id=495052

---

Updated on 2015-03-25