PT-2017-8720 · Firewalld+3 · Firewall+3

Huzaifa S. Sidhpurwala · Published 2016-11-03 · Updated 2024-06-15 · CVE-2016-5410

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions firewalld versions prior to 0.4.3.3

Description The issue allows local users to bypass authentication and modify firewall configurations. This can be achieved via specific D-Bus API methods, including addPassthrough, removePassthrough, addEntry, removeEntry, or setEntries.

Recommendations For versions prior to 0.4.3.3, update to version 0.4.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the D-Bus API methods addPassthrough, removePassthrough, addEntry, removeEntry, and setEntries to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2017-2182

CESA-2016_2597

CVE-2016-5410

OPENSUSE-SU-2024:10205-1

RHSA-2016:2597

RHSA-2016_2597

Affected Products

Alt Linux

Centos

Red Hat

Firewall

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2016-5410 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-5410 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPM3GUQRU2KPRXDEQLAMCDQEAIARJSBT · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10205-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1360135 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5410 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5410 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5410 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5410 · Security Note
• https://security.gentoo.org/glsa/201701-70 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2597.html · Vendor Advisory
• http://firewalld.org/2016/08/firewalld-0-4-3-3-release · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-5410 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJMYLGRVKIPJEI3VZJ4WQZT7FBQ5BKO · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/08/16/3 · Note