Foomuuri D-Bus Authorization Flaws Allow Unprivileged Firewall Manipulation
Two critical vulnerabilities in Foomuuri's D-Bus service expose firewall configuration to unauthorized local manipulation. Ubuntu has released security updates addressing improper authorization enforcement and interface validation issues.
TL;DR
- Foomuuri D-Bus service lacks proper authorization checks, allowing unprivileged users to modify firewall rules
- Interface name validation bypass enables attackers to manipulate firewall configuration in unintended ways
- Both CVE-2025-67603 and CVE-2025-67858 require local access but pose significant privilege escalation risks
- Ubuntu patch USN-8326-1 addresses authorization and validation deficiencies in the affected service
Foomuuri, a firewall management tool, contains two privilege escalation vulnerabilities in its D-Bus service that could allow unprivileged local attackers to compromise firewall security. Researcher Matthias Gerstner identified authorization enforcement gaps and input validation weaknesses that enable unauthorized firewall configuration changes.
These vulnerabilities highlight the importance of strict access controls on system-level services exposed through D-Bus. The flaws underscore how improper authorization checks and insufficient input validation can transform a local access requirement into a meaningful privilege escalation vector.
Ubuntu has released security update USN-8326-1 to address both issues. Organizations running Foomuuri should apply patches promptly to prevent local attackers from manipulating critical firewall policies.
Authorization Bypass in D-Bus Service
- CVE-2025-67603: D-Bus service fails to enforce proper authorization controls
- Unprivileged local users can bypass intended access restrictions
- Attackers gain ability to modify firewall configuration contrary to security policy
- Represents a privilege escalation from local user to firewall administrator capabilities
Interface Name Validation Weakness
- CVE-2025-67858: Insufficient validation of interface names in D-Bus requests
- Local attackers exploit validation gaps to manipulate firewall rules in unintended ways
- Improper input handling allows circumvention of intended firewall logic
- Combined with authorization bypass, enables comprehensive firewall policy compromise
Mitigation and Best Practices
- Apply Ubuntu security update USN-8326-1 immediately on affected systems
- Restrict local system access to trusted users only
- Monitor D-Bus service logs for unauthorized firewall configuration attempts
- Review firewall policies after patching to detect any unauthorized changes
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.