RHSA-2011:0953-01 -- Redhat system-config-firewall and system-config-printerID: oval:org.secpod.oval:def:500197 | Date: (C)2012-01-31 (M)2024-01-23 |
Class: PATCH | Family: unix |
system-config-firewall is a graphical user interface for basic firewall setup. It was found that system-config-firewall used the Python pickle module in an insecure way when sending data to the privileged back-end mechanism. A local user authorized to configure firewall rules using system-config-firewall could use this flaw to execute arbitrary code with root privileges, by sending a specially-crafted serialized object. Red Hat would like to thank Marco Slaviero of SensePost for reporting this issue. This erratum updates system-config-firewall to use JSON for data exchange, instead of pickle. Therefore, an updated version of system-config-printer that uses this new communication data format is also provided in this erratum. Users of system-config-firewall are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-firewall must be restarted before the utility will be able to communicate with its updated back-end.
Platform: |
Red Hat Enterprise Linux 6 |
Product: |
system-config-firewall |
system-config-printer |