Published: 17/04/2009 Updated: 13/02/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P

Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev prior to 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.

Vulnerable Product	Search on Vulmon	Subscribe to Product
udev project udev
opensuse opensuse 11.1
opensuse opensuse 11.0
opensuse opensuse 10.3
suse linux enterprise server 10
suse linux enterprise desktop 10
suse linux enterprise server 11
suse linux enterprise desktop 11
suse linux enterprise debuginfo 10
suse linux enterprise debuginfo 11
debian debian linux 5.0
debian debian linux 4.0
canonical ubuntu linux 7.10
canonical ubuntu linux 8.10
canonical ubuntu linux 8.04
canonical ubuntu linux 6.06
fedoraproject fedora 10
fedoraproject fedora 9

Sebastian Krahmer discovered that udev did not correctly validate netlink message senders A local attacker could send specially crafted messages to udev in order to gain root privileges (CVE-2009-1185) ...

Sebastian Kramer discovered two vulnerabilities in udev, the /dev and hotplug management daemon CVE-2009-1185 udev does not check the origin of NETLINK messages, allowing local users to gain root privileges CVE-2009-1186 udev suffers from a buffer overflow condition in path encoding, potentially allowing arbitrary code execution ...

CWE-120 http://www.securityfocus.com/bid/34539 http://secunia.com/advisories/34753 http://www.ubuntu.com/usn/usn-758-1 http://www.debian.org/security/2009/dsa-1772 http://secunia.com/advisories/34750 https://launchpad.net/bugs/cve/2009-1186 https://bugzilla.redhat.com/show_bug.cgi?id=495052 http://secunia.com/advisories/34731 http://secunia.com/advisories/34787 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.446399 http://www.securitytracker.com/id?1022068 http://wiki.rpath.com/Advisories:rPSA-2009-0063 http://secunia.com/advisories/34785 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.html http://secunia.com/advisories/34771 http://www.vupen.com/english/advisories/2009/1053 https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00462.html https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00463.html http://secunia.com/advisories/34801 http://www.gentoo.org/security/en/glsa/glsa-200904-18.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:103 http://secunia.com/advisories/34776 http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063 http://www.securityfocus.com/archive/1/502752/100/0/threaded http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=662c3110803bd8c1aedacc36788e6fd028944314 https://nvd.nist.gov https://usn.ubuntu.com/758-1/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-1186

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect