A vulnerability was reported in Red Hat system-config-firewall. A local user can obtain root privileges on the target system.
Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server EUS (v. 6.1.z)
Red Hat Enterprise Linux Workstation (v. 6)
Red Hat system-config-firewall Lets Local Users Gain Root Privileges
The system-config-firewall utility uses the Python pickle module in an insecure way when sending data (via D-Bus) to the privileged back-end mechanism. A local user with privileges to configure firewall rules can exploit this to send a specially-crafted serialized object to execute arbitrary commands on the target system with root privileges.
Users of system-config-firewall are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-firewall must be restarted before the utility will be able to communicate with its updated back-end.
A local user can obtain root privileges on the target system.
Updated system-config-firewall packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
To access Red Hat Network (RHN) to download software, updates, and security errata, your system should be registered to RHN.
Red Hat: Download