CVE-2011-2520: High severity red hat system-config-firewall vulnerability
fwdbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.
Other sources
Marco Slaviero reported a flaw in the use of python's pickle module as used in system-config-firewall that could allow local users to elevate their privileges to that of the root user. The pickle module is used to format messages between the system-config-firewall GUI and the system-config-firewall-mechanism.py privileged backend (that runs as root). The frontend and backend use D-Bus to communicate with each other, and pickle is known to permit the execution of arbitrary python code, so the untrusted user can send to the backend pickle shellcode that is executed in a privileged context.
The flaw depends on a number of non-standard configurable items to be set:
1) SELinux must be disabled (with SELinux enabled, certain actions can be executed as root, but they are extremely limited) 2) The user must be local, and using a GUI
Acknowledgements:
Red Hat would like to thank Marco Slaviero of SensePost for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2520?
CVE-2011-2520 is classified as a medium severity vulnerability due to possible privilege escalation by local users.
How do I fix CVE-2011-2520?
To fix CVE-2011-2520, upgrade system-config-firewall to version 1.2.30 or later, where the vulnerability has been addressed.
What systems are affected by CVE-2011-2520?
CVE-2011-2520 affects system-config-firewall versions 1.2.29 and earlier, as well as Fedora 15.
What type of vulnerability is CVE-2011-2520?
CVE-2011-2520 is a privilege escalation vulnerability arising from unsafe use of the pickle Python module during D-Bus communication.
Is CVE-2011-2520 exploitable remotely?
CVE-2011-2520 is not remotely exploitable; it requires local access to the affected system.