Vulnerability Description
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Firewalld | Firewalld | <= 0.4.3.2 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Hpc Node | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2016-2597.htmlThird Party Advisory
- http://www.firewalld.org/2016/08/firewalld-0-4-3-3-releasePatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/08/16/3Mailing List
- http://www.securityfocus.com/bid/92481Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1360135Issue TrackingPatch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/201701-70Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2597.htmlThird Party Advisory
- http://www.firewalld.org/2016/08/firewalld-0-4-3-3-releasePatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/08/16/3Mailing List
- http://www.securityfocus.com/bid/92481Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1360135Issue TrackingPatch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2016-5410?
CVE-2016-5410 is a vulnerability with a CVSS score of 5.5 (MEDIUM). firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry...
How severe is CVE-2016-5410?
CVE-2016-5410 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5410?
Check the references section above for vendor advisories and patch information. Affected products include: Firewalld Firewalld, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.