CVE-2016-5410: Medium severity Firewalld Firewalld vulnerability
FirewallD provides dbus api for modification of configuration after user has been authenticated via polkit. This does not apply for 5 methods which can be called by any logged user using dbus api or firewall-cmd cli interface. Any predefined policy can be used, server or desktop.
list of concerned dbus methods in firewalld.py addPassthrough removePassthrough addEntry removeEntry setEntries
Any locally logged in user, could use the above firewalld commands to tamper or change the firewall settings.
This flaw was introduced via the following commit: https://github.com/t-woerner/firewalld/commit/6b9867cd5c5e2c83adeec42666521a420e59ef11
It affects all firewalld versions since 0.3.12
Other sources
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5410?
CVE-2016-5410 has been assigned a medium severity rating due to the potential for unauthorized access to firewall configuration methods.
How do I fix CVE-2016-5410?
To mitigate CVE-2016-5410, upgrade to firewalld version 0.4.3.4 or later that addresses this vulnerability.
What are the affected versions for CVE-2016-5410?
CVE-2016-5410 affects firewalld versions up to 0.4.3.3.
Which systems are impacted by CVE-2016-5410?
CVE-2016-5410 impacts Red Hat Enterprise Linux Desktop, HPC Node, Server, and Workstation versions 7.0, as well as CentOS Firewalld versions up to 0.4.3.2.
Is CVE-2016-5410 related to user authentication?
Yes, CVE-2016-5410 allows logged users to invoke certain firewalld methods without proper authentication.