CVE-2012-3491 src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle j...
MediumCVSS 4.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/condor(Debian:13) | < 7.8.2~dfsg.1-1+deb7u1 | 7.8.2~dfsg.1-1+deb7u1 |
| debian/condor(Debian:14) | < 7.8.2~dfsg.1-1+deb7u1 | 7.8.2~dfsg.1-1+deb7u1 |
| condor project condor | = 7.6.0 | No fix listed |
| condor project condor | = 7.6.1 | No fix listed |
| condor project condor | = 7.6.2 | No fix listed |
| condor project condor | = 7.6.3 | No fix listed |
| condor project condor | = 7.6.4 | No fix listed |
| condor project condor | = 7.6.5 | No fix listed |
| condor project condor | = 7.6.6 | No fix listed |
| condor project condor | = 7.6.7 | No fix listed |
| condor project condor | = 7.6.8 | No fix listed |
| condor project condor | = 7.6.9 | No fix listed |
| condor project condor | = 7.8.0 | No fix listed |
| condor project condor | = 7.8.1 | No fix listed |
| condor project condor | = 7.8.2 | No fix listed |
| condor project condor | = 7.8.3 | No fix listed |
References
- Debian Security Tracker CVE-2012-3491 vendor-advisory
- condor-git.cs.wisc.edu
- research.cs.wisc.edu
- research.cs.wisc.edu
- RHSA-2012:1278 vendor-advisory
- RHSA-2012:1281 vendor-advisory
- 50666 third-party-advisory vendor-advisory
- [oss-security] 20120920 Notification of upstream Condor security fixes mailing-list
- 55632 vdb-entry
- bugzilla.redhat.com
- bugs.debian.org issue-tracking