Unscored severity · published Dec 23, 2009
CVE-2009-4133
Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user,…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job attribute.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Condor · Condor Project
6.5.4; 6.8.0; 6.8.1; 6.8.2; 6.8.3; 6.8.4; +26 more · source: NVD
EM
Enterprise Mrg · Redhat
1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4133
condor-wiki.cs.wisc.edu
http://condor-wiki.cs.wisc.edu/index.cgi/tktview?tn=1018
Vendor Advisory
http://secunia.com/advisories/37766
Vendor Advisory
http://secunia.com/advisories/37803
securitytracker.com
http://securitytracker.com/id?1023378
Vendor Advisory
http://www.cs.wisc.edu/condor/manual/v7.4/8_3Stable_Release.html#SECTION00931000000000000000
Vendor Advisory
http://www.cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2009-0001.html
More from Condor
–
CVE-2012-5390
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does no properly check privileges, which allows remote…
–
CVE-2011-4930
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local…
–
CVE-2013-4255
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL…
–
CVE-2009-5136
The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote…
–
CVE-2012-4462
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square…