Unscored severity · published Feb 10, 2014
CVE-2011-4930
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local…
–
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Condor · Condor Project
7.2.0; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5; +12 more · source: NVD
EM
Enterprise Mrg · Redhat
1.3; 2.0 · source: NVD
FE
Fedora · Fedoraproject
15; 16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4930
Vendor Advisory
http://research.cs.wisc.edu/htcondor/security/vulnerabilities/CONDOR-2012-0001.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0099.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0100.html
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=759548
htcondor-git.cs.wisc.edu
https://htcondor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=5e5571d1a431eb3c61977b6dd6ec90186ef79867
htcondor-wiki.cs.wisc.edu
https://htcondor-wiki.cs.wisc.edu/index.cgi/chngview?cn=28264
More from Condor
–
CVE-2012-5390
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does no properly check privileges, which allows remote…
–
CVE-2013-4255
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL…
–
CVE-2009-5136
The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote…
–
CVE-2012-4462
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square…
–
CVE-2012-5197
Multiple unspecified vulnerabilities in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors related to "error checking of system calls."