PT-2010-5338 · Red Hat · Condor+1

Vincent Danen · Published 2010-12-07 · Updated 2023-02-13 · CVE-2010-4179

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Messaging, Realtime and Grid (MRG) version 1.3

Description The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid (MRG) recommends a configuration that creates a trusted channel with insufficient access control. This allows local users with the ability to publish to a broker to run jobs as arbitrary users via Condor QMF plug-ins.

Recommendations For Red Hat Enterprise Messaging, Realtime and Grid (MRG) version 1.3, consider reconfiguring Condor to restrict the ability of local users to publish to a broker and run jobs as arbitrary users via Condor QMF plug-ins. As a temporary workaround, restrict access to the Condor QMF plug-ins to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-4179

RHSA-2010:0921

RHSA-2010:0922

Affected Products

Condor

Red Hat Enterprise Messaging

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-4179 · Security Note
• http://secunia.com/advisories/42406 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0922.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/3091 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0921.html · Vendor Advisory
• http://securitytracker.com/id?1024806 · Note
• https://t.me/cvenotify/17694 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=654856 · Note