system-config-firewall: privilege escalation/arbitrary code execution
| Package(s): | system-config-firewall |
CVE #(s): | CVE-2011-2520
|
| Created: | July 19, 2011 |
Updated: | August 2, 2011 |
| Description: |
From the Red Hat advisory:
It was found that system-config-firewall used the Python pickle module in
an insecure way when sending data (via D-Bus) to the privileged back-end
mechanism. A local user authorized to configure firewall rules using
system-config-firewall could use this flaw to execute arbitrary code with
root privileges, by sending a specially-crafted serialized object.
|
| Alerts: |
|
