CVE-2004-0318 Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluste...
HighCVSS 10.0
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| platform lsf | = 4.0 | No fix listed |
| platform lsf | = 4.2 | No fix listed |
| platform lsf | = 5.0 | No fix listed |
| platform lsf | = 5.1 | No fix listed |
| platform lsf | = 6.0 | No fix listed |
References
- 20040223 Lam3rZ Security Advisory #2/2004: LSF eauth vulnerability leads to a possibility of controlling cluster jobs on behalf of other users mailing-list
- 9724 exploit patch vdb-entry vendor-advisory
- lsf-eauth-process-hijack(15278) vdb-entry