CVE-2016-5410 firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry...
MediumCVSS 5.5
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firewalld(Debian:12) | < 0.4.3.3-1 | 0.4.3.3-1 |
| debian/firewalld(Debian:13) | < 0.4.3.3-1 | 0.4.3.3-1 |
| debian/firewalld(Debian:14) | < 0.4.3.3-1 | 0.4.3.3-1 |
| firewalld | <= 0.4.3.2 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-5410 vendor-advisory
- RHSA-2016:2597 third-party-advisory vendor-advisory
- www.firewalld.org patch vendor-advisory
- [oss-security] 20160816 firewalld: Firewall configuration can be modified by any logged in user mailing-list
- 92481 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch
- FEDORA-2016-de55d2c2c9 vendor-advisory
- FEDORA-2016-4dedc6ec3d vendor-advisory
- GLSA-201701-70 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking