PT-2009-6307 · University Of Wisconsin–Madison · Condor

Matthew Farrellee · Published 2009-12-23 · Updated 2021-07-15 · CVE-2009-4133

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Condor versions 6.5.4 through 7.2.4 Condor version 7.3.x Condor version 7.4.0

Description The issue allows remote authenticated users to queue jobs as an arbitrary user and gain privileges by modifying an unspecified job attribute using a Condor command-line tool.

Recommendations For Condor versions 6.5.4 through 7.2.4, consider restricting access to the command-line tool until a fix is available. For Condor version 7.3.x, restrict the ability to modify job attributes to prevent privilege escalation. For Condor version 7.4.0, limit the queueing of jobs to authorized users to mitigate the risk of exploitation.

Fix

Related Identifiers

CVE-2009-4133

RHSA-2009:1688

RHSA-2009:1689

Affected Products

Condor

References · 12

• http://redhat.com/support/errata/RHSA-2009-1689.html · Vendor Advisory
• http://cs.wisc.edu/condor/manual/v7.4/8_3Stable_Release.html#SECTION00931000000000000000 · Vendor Advisory
• http://secunia.com/advisories/37766 · Vendor Advisory
• http://cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2009-0001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1688.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4133 · Security Note
• http://secunia.com/advisories/37803 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54984 · Note
• http://securityfocus.com/bid/37443 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=544371 · Note
• http://securitytracker.com/id?1023378 · Note
• http://condor-wiki.cs.wisc.edu/index.cgi/tktview?tn=1018 · Note