Unscored severity · published Sep 28, 2012
CVE-2012-3491
src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to…
–
CVSS
1.8%
EPSS
No
On KEV
Description
src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Condor · Condor Project
7.6.0; 7.6.1; 7.6.2; 7.6.3; 7.6.4; 7.6.5; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3491
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3491
condor-git.cs.wisc.edu
http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=1fff5d40
research.cs.wisc.edu
http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html
research.cs.wisc.edu
http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1278.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1281.html
Vendor Advisory
http://secunia.com/advisories/50666
More from Condor
–
CVE-2012-5390
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does no properly check privileges, which allows remote…
–
CVE-2011-4930
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local…
–
CVE-2013-4255
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL…
–
CVE-2009-5136
The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote…
–
CVE-2012-4462
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square…