From ${URL} : FirewallD provides dbus api for modification of configuration after user has been authenticated via polkit. This does not apply for 5 methods which can be called by any logged user using dbus api or firewall-cmd cli interface. Any predefined policy can be used, server or desktop. list of concerned dbus methods in firewalld.py addPassthrough removePassthrough addEntry removeEntry setEntries Any locally logged in user, could use the above firewalld commands to tamper or change the firewall settings. This flaw was introduced via the following commit: https://github.com/t-woerner/firewalld/commit/6b9867cd5c5e2c83adeec42666521a420e59ef11 It affects all firewalld versions since 0.3.12 We have assigned CVE-2016-5410 to this flaw and this issue was previously disclosed via the linux-distros mailing list. A proposed patch is enclosed with this email. --- a/src/firewall/server/firewalld.py +++ a/src/firewall/server/firewalld.py @@ -61,8 +61,8 @@ class FirewallD(slip.dbus.service.Object): persistent = True """ Make FirewallD persistent. """ - default_polkit_auth_required = config.dbus.PK_ACTION_INFO - """ Use config.dbus.PK_ACTION_INFO as a default """ + default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG + """ Use config.dbus.PK_ACTION_CONFIG as a default """ @handle_exceptions def __init__(self, *args, **kwargs): @@ -2128,6 +2128,7 @@ class FirewallD(slip.dbus.service.Object): # DIRECT PASSTHROUGH (tracked) + @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='') @dbus_handle_exceptions @@ -2141,6 +2142,7 @@ class FirewallD(slip.dbus.service.Object): self.fw.direct.add_passthrough(ipv, args) self.PassthroughAdded(ipv, args) + @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='') @dbus_handle_exceptions @@ -2256,6 +2258,7 @@ class FirewallD(slip.dbus.service.Object): # set entries # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='') @dbus_handle_exceptions @@ -2268,6 +2271,7 @@ class FirewallD(slip.dbus.service.Object): self.fw.ipset.add_entry(ipset, entry) self.EntryAdded(ipset, entry) + @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='') @dbus_handle_exceptions @@ -2301,7 +2305,7 @@ class FirewallD(slip.dbus.service.Object): log.debug1("ipset.getEntries('%s')" % ipset) return self.fw.ipset.get_entries(ipset) - @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_INFO) + @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='sas') @dbus_handle_exceptions def setEntries(self, ipset, entries, sender=None): # pylint: disable=W0613 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Fixed in: 0.4.3.3 Vulnerable version left in tree: 0.3.13 commit 997165cd4bf00585c5579a29997d2246786c8dfd Author: Matthias Maier <tamiko@gentoo.org> Date: Wed Aug 17 08:44:32 2016 -0500 net-firewall/firewalld: drop vulnerable 0.4.2-r1, bug #591458 Package-Manager: portage-2.2.28 commit fa9ddf5093c3c25d62058128b868307b04dfe059 Author: Matthias Maier <tamiko@gentoo.org> Date: Wed Aug 17 08:43:47 2016 -0500 net-firewall/firewalld: version bump to 0.4.3.3 (CVE-2016-5410), bug #591458 Version 0.4.3.3 contains upstream fixes for CVE-2016-5410 Package-Manager: portage-2.2.28
Arches, please stabilize =net-firewall/firewalld-0.4.3.3 Target keywords: "amd64 x86"
amd64 stable
x86 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one.
commit 19e332c3aca10d0c1693f50a4811bc07cef9fab6 Author: Matthias Maier <tamiko@gentoo.org> Date: Thu Sep 29 08:53:08 2016 -0500 net-firewall/firewalld: drop vulnerable, bug #591458 Package-Manager: portage-2.3.0
This issue was resolved and addressed in GLSA 201701-70 at https://security.gentoo.org/glsa/201701-70 by GLSA coordinator Thomas Deutschmann (whissi).
