var-201107-0133
Vulnerability from variot

fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object. Red Hat system-config-firewall is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Successful exploits may aid in the compromise of affected computers. ----------------------------------------------------------------------

The Secunia Vulnerability Intelligence Manager (VIM) enables you to handle vulnerability threats in a simple, cost effective way.

Read more and request a free trial: http://secunia.com/products/corporate/vim/

TITLE: Red Hat update for system-config-firewall

SECUNIA ADVISORY ID: SA45294

VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45294/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45294

RELEASE DATE: 2011-07-24

DISCUSS ADVISORY: http://secunia.com/advisories/45294/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

http://secunia.com/advisories/45294/

ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=45294

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION: Red Hat has issued an update for system-config-firewall.

Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

PROVIDED AND/OR DISCOVERED BY: Marco Slaviero, SensePost

ORIGINAL ADVISORY: RHSA-2011:0953-1: https://rhn.redhat.com/errata/RHSA-2011-0953.html

OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

===================================================================== Red Hat Security Advisory

Synopsis: Moderate: system-config-firewall security update Advisory ID: RHSA-2011:0953-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0953.html Issue date: 2011-07-18 CVE Names: CVE-2011-2520 =====================================================================

  1. Summary:

Updated system-config-firewall packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - noarch Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64

  1. Description:

system-config-firewall is a graphical user interface for basic firewall setup.

It was found that system-config-firewall used the Python pickle module in an insecure way when sending data (via D-Bus) to the privileged back-end mechanism. (CVE-2011-2520)

Red Hat would like to thank Marco Slaviero of SensePost for reporting this issue.

This erratum updates system-config-firewall to use JSON (JavaScript Object Notation) for data exchange, instead of pickle. Therefore, an updated version of system-config-printer that uses this new communication data format is also provided in this erratum.

Users of system-config-firewall are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-firewall must be restarted before the utility will be able to communicate with its updated back-end.

  1. Solution:

Before applying this update, make sure all previously-released errata relevant to your system have been applied. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259

  1. Bugs fixed (http://bugzilla.redhat.com/):

717985 - CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle

  1. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/system-config-printer-1.1.16-17.el6_1.2.src.rpm

i386: system-config-printer-1.1.16-17.el6_1.2.i686.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.i686.rpm system-config-printer-libs-1.1.16-17.el6_1.2.i686.rpm system-config-printer-udev-1.1.16-17.el6_1.2.i686.rpm

noarch: system-config-firewall-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm

x86_64: system-config-printer-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-libs-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-udev-1.1.16-17.el6_1.2.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm

noarch: system-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm

noarch: system-config-firewall-1.2.27-3.el6_1.3.noarch.rpm

Red Hat Enterprise Linux Server (v. 6):

Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/system-config-printer-1.1.16-17.el6_1.2.src.rpm

i386: system-config-printer-1.1.16-17.el6_1.2.i686.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.i686.rpm system-config-printer-libs-1.1.16-17.el6_1.2.i686.rpm system-config-printer-udev-1.1.16-17.el6_1.2.i686.rpm

noarch: system-config-firewall-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm

ppc64: system-config-printer-1.1.16-17.el6_1.2.ppc64.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.ppc64.rpm system-config-printer-libs-1.1.16-17.el6_1.2.ppc64.rpm system-config-printer-udev-1.1.16-17.el6_1.2.ppc64.rpm

s390x: system-config-printer-1.1.16-17.el6_1.2.s390x.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.s390x.rpm system-config-printer-libs-1.1.16-17.el6_1.2.s390x.rpm system-config-printer-udev-1.1.16-17.el6_1.2.s390x.rpm

x86_64: system-config-printer-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-libs-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-udev-1.1.16-17.el6_1.2.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/system-config-printer-1.1.16-17.el6_1.2.src.rpm

i386: system-config-printer-1.1.16-17.el6_1.2.i686.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.i686.rpm system-config-printer-libs-1.1.16-17.el6_1.2.i686.rpm system-config-printer-udev-1.1.16-17.el6_1.2.i686.rpm

noarch: system-config-firewall-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm system-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm

x86_64: system-config-printer-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-debuginfo-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-libs-1.1.16-17.el6_1.2.x86_64.rpm system-config-printer-udev-1.1.16-17.el6_1.2.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package

  1. References:

https://www.redhat.com/security/data/cve/CVE-2011-2520.html https://access.redhat.com/security/updates/classification/#moderate

  1. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFOJK9mXlSAg2UNWIIRAo0BAJ41WBVD9620jZwW1ac2CkiIn49T4ACdFDbg jMJNzR30MDhT1RH8H5XkcA4= =IXvZ -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201107-0133",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "15"
      },
      {
        "model": "system-config-firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "1.2.29"
      },
      {
        "model": "red hat enterprise linux workstation",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": "6"
      },
      {
        "model": "red hat enterprise linux server eus",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "red hat enterprise linux desktop",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "red hat enterprise linux hpc node",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "red hat enterprise linux server",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.22"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.17"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.11"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.15"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.14"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.16"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.21"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.25"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.23"
      },
      {
        "model": "system-config-firewall",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "redhat",
        "version": "1.2.12"
      },
      {
        "model": "hat system-config-printer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "0"
      },
      {
        "model": "hat system-config-firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "0"
      },
      {
        "model": "hat enterprise linux workstation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "hat enterprise linux server eus 6.1.z",
        "scope": null,
        "trust": 0.3,
        "vendor": "red",
        "version": null
      },
      {
        "model": "hat enterprise linux server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "hat enterprise linux hpc node",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "hat enterprise linux desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "48715"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Marco Slaviero",
    "sources": [
      {
        "db": "BID",
        "id": "48715"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2011-2520",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 1.5,
            "id": "CVE-2011-2520",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 1.5,
            "id": "VHN-50465",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:L/AC:H/AU:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2011-2520",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2011-2520",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2011-2520",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2011-2520",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201107-232",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-50465",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object. Red Hat system-config-firewall is prone to a local privilege-escalation vulnerability. \nLocal attackers can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Successful exploits may aid in the compromise of affected computers. ----------------------------------------------------------------------\n\nThe Secunia Vulnerability Intelligence Manager (VIM) enables you to handle vulnerability threats in a simple, cost effective way. \n\nRead more and request a free trial:\nhttp://secunia.com/products/corporate/vim/\n\n----------------------------------------------------------------------\n\nTITLE:\nRed Hat update for system-config-firewall\n\nSECUNIA ADVISORY ID:\nSA45294\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/45294/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=45294\n\nRELEASE DATE:\n2011-07-24\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/45294/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/45294/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=45294\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nRed Hat has issued an update for system-config-firewall. \n\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nPROVIDED AND/OR DISCOVERED BY:\nMarco Slaviero, SensePost\n\nORIGINAL ADVISORY:\nRHSA-2011:0953-1:\nhttps://rhn.redhat.com/errata/RHSA-2011-0953.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: system-config-firewall security update\nAdvisory ID:       RHSA-2011:0953-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://rhn.redhat.com/errata/RHSA-2011-0953.html\nIssue date:        2011-07-18\nCVE Names:         CVE-2011-2520 \n=====================================================================\n\n1. Summary:\n\nUpdated system-config-firewall packages that fix one security issue are now\navailable for Red Hat Enterprise Linux 6. \n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64\nRed Hat Enterprise Linux HPC Node (v. 6) - noarch\nRed Hat Enterprise Linux HPC Node Optional (v. 6) - noarch\nRed Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64\n\n3. Description:\n\nsystem-config-firewall is a graphical user interface for basic firewall\nsetup. \n\nIt was found that system-config-firewall used the Python pickle module in\nan insecure way when sending data (via D-Bus) to the privileged back-end\nmechanism. \n(CVE-2011-2520)\n\nRed Hat would like to thank Marco Slaviero of SensePost for reporting this\nissue. \n\nThis erratum updates system-config-firewall to use JSON (JavaScript Object\nNotation) for data exchange, instead of pickle. Therefore, an updated\nversion of system-config-printer that uses this new communication data\nformat is also provided in this erratum. \n\nUsers of system-config-firewall are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue. Running\ninstances of system-config-firewall must be restarted before the utility\nwill be able to communicate with its updated back-end. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259\n\n5. Bugs fixed (http://bugzilla.redhat.com/):\n\n717985 - CVE-2011-2520 system-config-firewall: privilege escalation flaw via use of python pickle\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/system-config-printer-1.1.16-17.el6_1.2.src.rpm\n\ni386:\nsystem-config-printer-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.i686.rpm\n\nnoarch:\nsystem-config-firewall-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm\n\nx86_64:\nsystem-config-printer-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm\n\nnoarch:\nsystem-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm\n\nRed Hat Enterprise Linux HPC Node Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm\n\nnoarch:\nsystem-config-firewall-1.2.27-3.el6_1.3.noarch.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/system-config-printer-1.1.16-17.el6_1.2.src.rpm\n\ni386:\nsystem-config-printer-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.i686.rpm\n\nnoarch:\nsystem-config-firewall-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm\n\nppc64:\nsystem-config-printer-1.1.16-17.el6_1.2.ppc64.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.ppc64.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.ppc64.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.ppc64.rpm\n\ns390x:\nsystem-config-printer-1.1.16-17.el6_1.2.s390x.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.s390x.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.s390x.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.s390x.rpm\n\nx86_64:\nsystem-config-printer-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/system-config-firewall-1.2.27-3.el6_1.3.src.rpm\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/system-config-printer-1.1.16-17.el6_1.2.src.rpm\n\ni386:\nsystem-config-printer-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.i686.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.i686.rpm\n\nnoarch:\nsystem-config-firewall-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-base-1.2.27-3.el6_1.3.noarch.rpm\nsystem-config-firewall-tui-1.2.27-3.el6_1.3.noarch.rpm\n\nx86_64:\nsystem-config-printer-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-debuginfo-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-libs-1.1.16-17.el6_1.2.x86_64.rpm\nsystem-config-printer-udev-1.1.16-17.el6_1.2.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and \ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2011-2520.html\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFOJK9mXlSAg2UNWIIRAo0BAJ41WBVD9620jZwW1ac2CkiIn49T4ACdFDbg\njMJNzR30MDhT1RH8H5XkcA4=\n=IXvZ\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "BID",
        "id": "48715"
      },
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "db": "PACKETSTORM",
        "id": "103341"
      },
      {
        "db": "PACKETSTORM",
        "id": "103148"
      }
    ],
    "trust": 2.16
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-50465",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2011-2520",
        "trust": 3.7
      },
      {
        "db": "BID",
        "id": "48715",
        "trust": 2.8
      },
      {
        "db": "SECUNIA",
        "id": "45294",
        "trust": 2.6
      },
      {
        "db": "SECTRACK",
        "id": "1025793",
        "trust": 2.5
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2011/07/18/6",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "73976",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "103148",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-50465",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "103341",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "db": "BID",
        "id": "48715"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "PACKETSTORM",
        "id": "103341"
      },
      {
        "db": "PACKETSTORM",
        "id": "103148"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "id": "VAR-201107-0133",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:46:51.925000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "RHSA-2011",
        "trust": 0.8,
        "url": "https://rhn.redhat.com/errata/RHSA-2011-0953.html"
      },
      {
        "title": "system-config-firewall Fixes for permissions and access control issues vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=234649"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-502",
        "trust": 1.0
      },
      {
        "problemtype": "Deserialization of untrusted data (CWE-502) [NVD evaluation ]",
        "trust": 0.8
      },
      {
        "problemtype": "CWE-264",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://secunia.com/advisories/45294"
      },
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/48715"
      },
      {
        "trust": 1.7,
        "url": "http://securitytracker.com/id?1025793"
      },
      {
        "trust": 1.7,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-august/063314.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.redhat.com/support/errata/rhsa-2011-0953.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2011/07/18/6"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717985"
      },
      {
        "trust": 1.7,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68734"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2520"
      },
      {
        "trust": 0.8,
        "url": "http://www.securitytracker.com/id/1025793"
      },
      {
        "trust": 0.8,
        "url": "http://osvdb.org/73976"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2011-2520"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/errata/rhsa-2011:0953"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2011-2520"
      },
      {
        "trust": 0.3,
        "url": "http://permalink.gmane.org/gmane.comp.security.oss.general/5506"
      },
      {
        "trust": 0.3,
        "url": "http://www.python.org/"
      },
      {
        "trust": 0.2,
        "url": "https://rhn.redhat.com/errata/rhsa-2011-0953.html"
      },
      {
        "trust": 0.1,
        "url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=45294"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_intelligence/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/45294/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/products/corporate/vim/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/45294/#comments"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/personal/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/kb/docs/doc-11259"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/#package"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-2520"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2011-2520.html"
      },
      {
        "trust": 0.1,
        "url": "http://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "db": "BID",
        "id": "48715"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "PACKETSTORM",
        "id": "103341"
      },
      {
        "db": "PACKETSTORM",
        "id": "103148"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "db": "BID",
        "id": "48715"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "db": "PACKETSTORM",
        "id": "103341"
      },
      {
        "db": "PACKETSTORM",
        "id": "103148"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2011-07-21T00:00:00",
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "date": "2011-07-19T00:00:00",
        "db": "BID",
        "id": "48715"
      },
      {
        "date": "2011-08-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "date": "2011-07-24T06:05:29",
        "db": "PACKETSTORM",
        "id": "103341"
      },
      {
        "date": "2011-07-19T02:44:29",
        "db": "PACKETSTORM",
        "id": "103148"
      },
      {
        "date": "2011-07-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "date": "2011-07-21T23:55:03.410000",
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-02-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-50465"
      },
      {
        "date": "2015-04-13T21:23:00",
        "db": "BID",
        "id": "48715"
      },
      {
        "date": "2024-02-21T06:15:00",
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      },
      {
        "date": "2023-04-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      },
      {
        "date": "2024-11-21T01:28:27.153000",
        "db": "NVD",
        "id": "CVE-2011-2520"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "BID",
        "id": "48715"
      },
      {
        "db": "PACKETSTORM",
        "id": "103341"
      },
      {
        "db": "PACKETSTORM",
        "id": "103148"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      }
    ],
    "trust": 1.1
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Used in Red Hat products \u00a0system-config-firewall\u00a0 of \u00a0fw_dbus.py\u00a0 Privilege Acquisition Vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2011-002088"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control issues",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201107-232"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.