PT-2011-3675 · Adaptive Computing · Torque Resource Manager

Published 2011-06-24 · Updated 2018-10-09 · CVE-2011-2193

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TORQUE Resource Manager versions 2.x through 2.4.13 TORQUE Resource Manager versions 2.5.x through 2.5.5 TORQUE Resource Manager versions 3.x through 3.0.1

Description The issue concerns buffer overflows in the TORQUE Resource Manager. Remote authenticated users may gain privileges by submitting a qsub command with a long Job Name field to the server. Additionally, local users might gain privileges through vectors involving a long host variable in pbs iff.

Recommendations For versions 2.x through 2.4.13, update to version 2.4.14 or later. For versions 2.5.x through 2.5.5, update to version 2.5.6 or later. For versions 3.x through 3.0.1, update to version 3.0.2 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-2193

DSA-2329-1

Affected Products

Torque Resource Manager

References · 14

• https://bugzilla.redhat.com/show_bug.cgi?id=711463 · Patch
• http://secunia.com/advisories/45040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2193 · Security Note
• http://secunia.com/advisories/45039 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061645.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2329 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062638.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68151 · Note
• http://securityfocus.com/bid/48374 · Note
• http://securityfocus.com/archive/1/518885/100/0/threaded · Note
• http://clusterresources.com/downloads/torque/CHANGELOGS/torque-2.4.14.CHANGELOG · Note
• http://clusterresources.com/downloads/torque/CHANGELOGS/torque-2.5.6.CHANGELOG · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68152 · Note
• http://securityreason.com/securityalert/8304 · Note