You are here

T-671: Red Hat system-config-firewall Lets Local Users Gain Root Privileges

July 19, 2011 - 2:42pm

Addthis

PROBLEM:

A vulnerability was reported in Red Hat system-config-firewall. A local user can obtain root privileges on the target system.

PLATFORM

Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server EUS (v. 6.1.z)
Red Hat Enterprise Linux Workstation (v. 6)

ABSTRACT:

Red Hat system-config-firewall Lets Local Users Gain Root Privileges

reference LINKS:

RHSA-2011:0953-1
SecurityTracker Alert ID: 1025793
CVE-2011-2520
Red hat Article ID: 11259

IMPACT ASSESSMENT:

Medium

Discussion:

The system-config-firewall utility uses the Python pickle module in an insecure way when sending data (via D-Bus) to the privileged back-end mechanism. A local user with privileges to configure firewall rules can exploit this to send a specially-crafted serialized object to execute arbitrary commands on the target system with root privileges.

This erratum updates system-config-firewall to use JSON (JavaScript Object Notation) for data exchange, instead of pickle. Therefore, an updated version of system-config-printer that uses this new communication data format is also provided in this erratum.

Users of system-config-firewall are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-firewall must be restarted before the utility will be able to communicate with its updated back-end.

Impact:

A local user can obtain root privileges on the target system.

Updated system-config-firewall packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

Solution:

To access Red Hat Network (RHN) to download software, updates, and security errata, your system should be registered to RHN.
Red Hat: Download

 

Addthis