PT-2013-1376 · Htcondor · Condor

Martin Kudlej · Publicado 2013-10-11 · Atualizado 2021-07-15 · CVE-2009-5136

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Condor versions prior to 7.4.2

Description The policy definition evaluator does not properly handle attributes in a WANT SUSPEND policy that evaluate to an UNDEFINED state. This allows remote authenticated users to cause a denial of service (condor startd exit) via a crafted job.

Recommendations For versions prior to 7.4.2, update to version 7.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the WANT SUSPEND policy to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-5136

Produtos afetados

Condor

Referências · 6

• http://rhn.redhat.com/errata/RHSA-2010-0773.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=540545 · Nota
• http://research.cs.wisc.edu/htcondor/manual/v7.6/8_5Stable_Release.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-5136 · Nota de Segurança
• https://htcondor-wiki.cs.wisc.edu/index.cgi/tktview?tn=1001 · Nota
• https://t.me/cvenotify/17693 · Publicação no Telegram