CVE-2009-5136 The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote authenticated users to caus...
MediumCVSS 4.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| condor project condor | <= 7.4.1 | No fix listed |
| condor project condor | = 7.4.0 | No fix listed |
| redhat enterprise mrg | = 1.0 | No fix listed |
| redhat enterprise mrg | = 1.0.1 | No fix listed |
| redhat enterprise mrg | = 1.0.2 | No fix listed |
| redhat enterprise mrg | = 1.0.3 | No fix listed |
| redhat enterprise mrg | = 1.1.1 | No fix listed |
| redhat enterprise mrg | = 1.1.2 | No fix listed |
| redhat enterprise mrg | = 1.2 | No fix listed |
| redhat enterprise mrg | = 1.2.2 | No fix listed |
References
- research.cs.wisc.edu
- RHSA-2010:0773 vendor-advisory
- bugzilla.redhat.com
- htcondor-wiki.cs.wisc.edu
- Debian Security Tracker CVE-2009-5136 vendor-advisory