RHSA-2016:2597 - Security Advisory

Topic

An update for firewalld is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

The following packages have been upgraded to a newer upstream version: firewalld (0.4.3.2). (BZ#1302802)

Security Fix(es):

• A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change firewall settings. (CVE-2016-5410)

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1066037 - firewall-config should allow unspecifying zone binding for interface
• BZ - 1136801 - a rule added into IN_<zone>_allow chain with 'permanent direct' interface doesn't exist after reload
• BZ - 1147500 - RFE: add command to firewall-cmd showing details of a service
• BZ - 1147951 - firewall-cmd should support a default logging option.
• BZ - 1219717 - Add radius TCP to policy.
• BZ - 1220196 - Firewalld missing policies for imap and smtps
• BZ - 1220467 - Option '--quiet' is needed in firewall-offline-cmd command line.
• BZ - 1237242 - Error: RT_TO_PERM_FAILED: zone 'dmz' : ZONE_CONFLICT when doing --runtime-to-permanent
• BZ - 1273296 - [ALL_LANG][firewalld] Translation incomplete
• BZ - 1273888 - Firewalld DefaultZone change breaking on --reload
• BZ - 1281416 - Headless firewall-config over ssh. firewall-config missing dependencies
• BZ - 1285769 - Fails to start without ip6t_rpfilter module
• BZ - 1292926 - firewalld --new-service & malformed xml ??
• BZ - 1296573 - xsd specification nor service daemon checks whether tags are specified more than once if they must not
• BZ - 1301573 - firewalld reporting errors in logs for failed iptables commands
• BZ - 1302802 - Rebase to the new upstream and new release
• BZ - 1303026 - firewalld - mistake in <ports> renders ports remain closed, silently.
• BZ - 1305434 - Firewalld hangs with a NIS configuration
• BZ - 1313023 - command "systemctl reload firewalld" stops firewalld
• BZ - 1313845 - Backport After=dbus.service
• BZ - 1325335 - [RFE] allow negation of icmp-blocks zone configuration field
• BZ - 1326130 - firewalld stops traffic from/to 127.0.0.1 when masquerading is enabled in default zone
• BZ - 1326462 - rich rule with destination and no element give error
• BZ - 1347530 - Add port for corosync-qnetd to high-availability service
• BZ - 1349903 - FirewallD fails to parse direct rules with a lot of destination addresses
• BZ - 1357050 - exit codes don't match error messages in firewall-cmd
• BZ - 1360135 - CVE-2016-5410 firewalld: Firewall configuration can be modified by any logged in user
• BZ - 1360894 - Print errors and warnings to stderr
• BZ - 1365198 - firewall-cmd ipset --add-entries-from-file broken
• BZ - 1367038 - firewall-cmd crashes if /run/dbus/system_bus_socket does not exist
• BZ - 1368949 - Trying to get the description for a firewalld zone from command line throws error and prints traceback information.
• BZ - 1371116 - Load helper modules in FirewallZoneTransaction
• BZ - 1373260 - An error in the permanent direct rules will make all other direct rules using a table other than the filter table not applicable.
• BZ - 1374799 - exclude firewallctl from firewalld v0.4.3.2 update

CVEs

• CVE-2016-5410

References

• https://access.redhat.com/security/updates/classification/#moderate