firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.

According to the version of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - firewalld.py in firewalld before 0.4.3.3 allows local     users to bypass authentication and modify firewall     configurations via the (1) addPassthrough, (2)     removePassthrough, (3) addEntry, (4) removeEntry, or     (5) setEntries D-Bus API method.(CVE-2016-5410)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-70 (Firewalld: Improper authentication methods)

    A flaw in Firewalld allows any locally logged in user to tamper with or       change firewall settings.  This is due to how Firewalld handles       authentication via polkit which is not properly applied to 5 particular       functions to include: addPassthrough, removePassthrough, addEntry,       removeEntry, and setEntries.
  Impact :

    A local attacker could tamper or change firewall settings leading to the       additional exposure of systems to include unauthorized remote access.
  Workaround :

    There is no known workaround at this time.

The following packages have been upgraded to a newer upstream version:
firewalld (0.4.3.2).

Security Fix(es) :

  - A flaw was found in the way firewalld allowed certain     firewall configurations to be modified by     unauthenticated users. Any locally logged in user could     use this flaw to tamper or change firewall settings.
    (CVE-2016-5410)

Additional Changes :

An update for firewalld is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

The following packages have been upgraded to a newer upstream version:
firewalld (0.4.3.2). (BZ#1302802)

Security Fix(es) :

* A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change firewall settings. (CVE-2016-5410)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

- Fix CVE-2016-5410: Firewall configuration can be     modified by any logged in user

  - firewall/server/firewalld: Make getXSettings and     getLogDenied CONFIG_INFO

  - Update AppData configuration file.

  - tests/firewalld_rich.py: Use new import structure and     FirewallClient classes

  - tests/firewalld_direct.py: Use new import structure

  - tests: firewalld_direct: Fix assert to check for True     instead of False

  - tests: firewalld_config: Fix expected value when     querying the zone target

  - tests: firewalld_config: Use real nf_conntrack modules

  - firewalld.spec: Added comment about make call for %build

  - firewall-config: Use also width_request and     height_request with default size

  - Updated firewall-config screenshot

  - firewall-cmd: Fixed typo in help output (RHBZ#1367171)

  - test-suite: Ignore stderr to get default zone also for     missing firewalld.conf

  - firewall.core.logger: Warnings should be printed to     stderr per default

  - firewall.core.fw_nm: Ignore NetworkManager if NM.Client     connect fails

  - firewall-cmd, firewallctl: Gracefully fail if SystemBus     can not be aquired

  - firewall.client: Generate new DBUS_ERROR if SystemBus     can not be aquired

  - test-suite: Do not fail on ALREADY_ENABLED
    --add-destination tests

  - firewall.command: ALREADY_ENABLED, NOT_ENABLED,     ZONE_ALREADY_SET are warnings

  - doc/xml/firewalld.dbus.xml: Removed undefined reference

  - doc/xml/transform-html.xsl.in: Fixed references in the     document

  - doc/xml/firewalld.{dbus,zone}.xml: Embed programlisting     in para

  - doc/xml/transform-html.xsl.in: Enhanced html formatting     closer to the man page

  - firewall: core: fw_nm: Instantiate the NM client only     once

  - firewall/core/io/*.py: Do not traceback on a general sax     parsing issue

  - firewall-offline-cmd: Fix
    --{add,remove}-entries-from-file

  - firewall-cmd: Add missing action to fix
    --{add,remove}-entries-from-file

  - firewall.core.prog: Do not output stderr, but return it     in the error case

  - firewall.core.io.ifcfg.py: Fix ifcfg file reader and     writer (RHBZ#1362171)

  - config/firewall.service.in: use KillMode=mixed

  - config/firewalld.service.in: use network-pre.target

  - firewall-config: Add missing gettext.textdomain call to     fix translations

  - Add UDP to transmission-client.xml service

  - tests/firewall-[offline-]cmd_test.sh: Hide errors and     warnings

  - firewall.client: Fix ALREADY_ENABLED errors in icmptype     destination calls

  - firewall.client: Fix NOT_ENABLED errors in icmptype     destination calls

  - firewall.client: Use {ALREADY,NOT}_ENABLED errors in     icmptype destination calls

  - firewall.command: Add the removed FirewallError handling     to the action (a17ce50)

  - firewall.command: Do not use query methods for sequences     and also single options

  - Add missing information about MAC and ipset sources to     man pages and help output

  - firewalld.spec: Add BuildRequires for libxslt to enable     rebuild of man pages

  - firewall[-offline]-cmd, firewallctl, firewall.command:
    Use sys.{stdout,stderr}

  - firewallctl: Fix traceback if not connected to firewalld

  - firewall-config: Initialize value in     on_richRuleDialogElementChooser_clicked

  - firewall.command: Convert errors to string for Python3

  - firewall.command: Get proper firewall error code from     D-BusExceptions

  - firewall-cmd: Fixed traceback without args

  - Add missing service files to Makefile.am

  - shell-completion: Add shell completion support for

    --{get,set}--{description,short}

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2597 advisory.

    - Fixed CVE-2016-5410 (RHBZ#1359296)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2597 advisory.

    firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus     interface.

    The following packages have been upgraded to a newer upstream version: firewalld (0.4.3.2). (BZ#1302802)

    Security Fix(es):

    * A flaw was found in the way firewalld allowed certain firewall configurations to be modified by     unauthenticated users. Any locally logged in user could use this flaw to tamper or change firewall     settings. (CVE-2016-5410)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
131869	EulerOS 2.0 SP2 : firewalld (EulerOS-SA-2019-2377)	Nessus	Huawei Local Security Checks	medium
96856	GLSA-201701-70 : Firewalld: Improper authentication methods	Nessus	Gentoo Local Security Checks	medium
95837	Scientific Linux Security Update : firewalld on SL7.x (noarch) (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95343	CentOS 7 : firewalld (CESA-2016:2597)	Nessus	CentOS Local Security Checks	medium
94803	Fedora 25 : firewalld (2016-4dedc6ec3d)	Nessus	Fedora Local Security Checks	medium
94716	Oracle Linux 7 : firewalld (ELSA-2016-2597)	Nessus	Oracle Linux Local Security Checks	medium
94560	RHEL 7 : firewalld (RHSA-2016:2597)	Nessus	Red Hat Local Security Checks	medium
93060	Fedora 24 : firewalld (2016-de55d2c2c9)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-5410

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium