PT-2012-4758 · Htcondor · Condor

Florian Weimer · Published 2012-09-28 · Updated 2012-10-03 · CVE-2012-3493

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Condor versions 7.6.x through 7.6.9 Condor versions 7.8.x through 7.8.3

Description The issue allows remote attackers to obtain sensitive information and possibly control or start arbitrary jobs via a ClassAd request to the condor startd port. This is due to a leak of the ClaimId in the command give request ad function.

Recommendations For Condor versions 7.6.x through 7.6.9, update to version 7.6.10 or later. For Condor versions 7.8.x through 7.8.3, update to version 7.8.4 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-3493

RHSA-2012:1278

RHSA-2012:1281

Affected Products

Condor

References · 13

• http://rhn.redhat.com/errata/RHSA-2012-1281.html · Vendor Advisory
• http://secunia.com/advisories/50666 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1278.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3493 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-3493 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3493 · Vendor Advisory
• http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=d2f33972 · Note
• http://securityfocus.com/bid/55632 · Note
• http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html · Note
• http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html · Note
• http://openwall.com/lists/oss-security/2012/09/20/9 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=848222 · Note