A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change firewall settings.
FirewallD provides dbus api for modification of configuration after user has been authenticated via polkit. This does not apply for 5 methods which can be called by any logged user using dbus api or firewall-cmd cli interface. Any predefined policy can be used, server or desktop.
list of concerned dbus methods in firewalld.py
Any locally logged in user, could use the above firewalld commands to tamper or change the firewall settings.
This flaw was introduced via the following commit:
It affects all firewalld versions since 0.3.12
Created firewalld tracking bugs for this issue:
Affects: fedora-all [bug 1367381]
This issue was fixed in firewalld-0.4.3.3 release:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:2597 https://rhn.redhat.com/errata/RHSA-2016-2597.html