CVE-2016-5410

MEDIUM

firewalld < 0.4.3.3 - Unauthenticated Firewall Configuration Modification via D-Bus API

Title source: llm
STIX 2.1

Description

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.

References (8)

Core 8
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www.firewalld.org/2016/08/firewalld-0-4-3-3-release
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92481
Issue Tracking, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1360135
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201701-70
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2597.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/08/16/3

Scores

CVSS v3 5.5
EPSS 0.0036
EPSS Percentile 28.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-287
Status published
Products (5)
firewalld/firewalld < 0.4.3.2
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_hpc_node 7.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_workstation 7.0
Published Apr 19, 2017
Tracked Since Feb 18, 2026