CVE-2011-2520
published 2011-07-21CVE-2011-2520: fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend…
PriorityP335high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.42%
34.7th percentile
fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| redhat | system-config-firewall | <= 1.2.29 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:L/AC:H/Au:S/C:C/I:C/A:C
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j359-qhq6-r897: fw_dbus
ghsa_unreviewed·2022-05-17
CVE-2011-2520 [MEDIUM] CWE-502 GHSA-j359-qhq6-r897: fw_dbus
fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.
Red Hat
system-config-firewall: privilege escalation flaw via use of python pickle
vendor_redhat·2011-07-18·CVSS 7.8
CVE-2011-2520 [HIGH] CWE-502 system-config-firewall: privilege escalation flaw via use of python pickle
system-config-firewall: privilege escalation flaw via use of python pickle
fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle [fedora-all]
bugzilla·2011-07-18·CVSS 7.8
CVE-2011-2520 [HIGH] CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle [fedora-all]
CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=717985
Please note:
Bugzilla
CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle [fedora-all]
bugzilla·2011-07-18·CVSS 7.8
CVE-2011-2520 [HIGH] CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle [fedora-all]
CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=717985
Please note:
Bugzilla
CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle
bugzilla·2011-06-30·CVSS 7.8
CVE-2011-2520 [HIGH] CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle
CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle
Marco Slaviero reported a flaw in the use of python's pickle module as used in system-config-firewall that could allow local users to elevate their privileges to that of the root user. The pickle module is used to format messages between the system-config-firewall GUI and the system-config-firewall-mechanism.py privileged backend (that runs as root). The frontend and backend use D-Bus to communicate with each other, and pickle is known to permit the execution of arbitrary python code, so the untrusted user can send to the backend pickle shellcode that is executed in a privileged context.
The flaw depends on a number of non-standard configurable items to be set:
1) SELinux must be disabled (with SELi
CWE
Improperly Controlled Modification of Dynamically-Determined Object Attributes
mitre_cwe
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, autobinding, or object injection.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Modify Application Data. An attacker could modify sensitive d
CWE
Deserialization of Untrusted Data
mitre_cwe
CWE-502 Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Background: Serialization and deserialization refer to the process of taking program-internal object-related data, packaging it in a way that allows the data to be externally stored or transferred ("serialization"), then extracting the serialized data to reconstruct the original object ("deserialization").
Modes of Introduction:
Phase: Architecture and Design
Note: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Modify Application Data, Unexpected State. Attackers can modify unexpected objects or data that was as
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063314.htmlhttp://secunia.com/advisories/45294http://securitytracker.com/id?1025793http://www.openwall.com/lists/oss-security/2011/07/18/6http://www.redhat.com/support/errata/RHSA-2011-0953.htmlhttp://www.securityfocus.com/bid/48715https://bugzilla.redhat.com/show_bug.cgi?id=717985https://exchange.xforce.ibmcloud.com/vulnerabilities/68734http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063314.htmlhttp://secunia.com/advisories/45294http://securitytracker.com/id?1025793http://www.openwall.com/lists/oss-security/2011/07/18/6http://www.redhat.com/support/errata/RHSA-2011-0953.htmlhttp://www.securityfocus.com/bid/48715https://bugzilla.redhat.com/show_bug.cgi?id=717985https://exchange.xforce.ibmcloud.com/vulnerabilities/68734
2011-07-21
Published