PT-2013-1376 · Htcondor · Condor

Martin Kudlej · Published 2013-10-11 · Updated 2021-07-15 · CVE-2009-5136

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Condor versions prior to 7.4.2

Description The policy definition evaluator does not properly handle attributes in a WANT SUSPEND policy that evaluate to an UNDEFINED state. This allows remote authenticated users to cause a denial of service (condor startd exit) via a crafted job.

Recommendations For versions prior to 7.4.2, update to version 7.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the WANT SUSPEND policy to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-5136

Affected Products

Condor

References · 6

• http://rhn.redhat.com/errata/RHSA-2010-0773.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-5136 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=540545 · Note
• http://research.cs.wisc.edu/htcondor/manual/v7.6/8_5Stable_Release.html · Note
• https://htcondor-wiki.cs.wisc.edu/index.cgi/tktview?tn=1001 · Note
• https://t.me/cvenotify/17693 · Telegram Post