CVSS: 5.8EPSS: 0%CPEs: 14EXPL: 0CVE-2012-3493 – condor: GIVE_REQUEST_AD leaks privileged ClaimId information
https://notcve.org/view.php?id=CVE-2012-3493
The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which leaks the ClaimId. La función command_give_request_ad en condor_startd.V6/command.cpp en Condor v7.6.x antes de v7.6.10 y v7.8.x antes de v7.8.4 permite a atacantes remotos obtener información sensible y posiblemente controlar o iniciar trabajos (jobs) de su elección a través de una solicitud ClassAd al puerto condor_startd, lo provoca una fuga del ClaimID. • http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=d2f33972 http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html http://rhn.redhat.com/errata/RHSA-2012-1278.html http://rhn.redhat.com/errata/RHSA-2012-1281.html http://secunia.com/advisories/50666 http://www.openwall.com/lists/oss-security/2012/09/20/9 http://www.securityfocus.com/bid/55632 https://bugzilla.r • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 1%CPEs: 39EXPL: 0CVE-2012-3416 – condor: host based authentication does not implement forward-confirmed reverse dns
https://notcve.org/view.php?id=CVE-2012-3416
Condor before 7.8.2 allows remote attackers to bypass host-based authentication and execute actions such as ALLOW_ADMINISTRATOR or ALLOW_WRITE by connecting from a system with a spoofed reverse DNS hostname. Condor antes de v7.8.2 permite a atacantes remotos evitar la auntenticación basada en host y ejecutar acciones como ALLOW_ADMINISTRATOR o ALLOW_WRITE conectando desde un sistema con un hostname DNS inverso falsificado • http://osvdb.org/84766 http://research.cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2012-0002.html http://rhn.redhat.com/errata/RHSA-2012-1168.html http://rhn.redhat.com/errata/RHSA-2012-1169.html http://secunia.com/advisories/50246 http://secunia.com/advisories/50294 http://www.securityfocus.com/bid/55032 http://www.securitytracker.com/id?1027395 https://exchange.xforce.ibmcloud.com/vulnerabilities/77748 https://access.redhat.com/security/cve/CVE-2012-3416 https://b • CWE-284: Improper Access Control CWE-287: Improper Authentication •
CVSS: 5.2EPSS: 0%CPEs: 22EXPL: 0CVE-2011-4930 – Condor: Multiple format string flaws
https://notcve.org/view.php?id=CVE-2011-4930
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors. Múltiples vulnerabilidades de cadena de formato en Condor 7.2.0 hasta 7.6.4 y posiblemente ciertas versiones 7.7.x, como las utilizadas en Red Hat MRG Grid y posiblemente otros productos, permiten a usuarios locales causar una denegación de servicio (demonio condor_schedd y fallo en el lanzamiento de trabajos) y posiblemente ejecutar código arbitrario a través de una cadena de especificadores de formato en (1) la razón de un retraso en un trabajo que utiliza un registro de usuario XML, (2) el nombre de un archivo pendiente de transferir y posiblemente otros vectores no especificados. • http://research.cs.wisc.edu/htcondor/security/vulnerabilities/CONDOR-2012-0001.html http://rhn.redhat.com/errata/RHSA-2012-0099.html http://rhn.redhat.com/errata/RHSA-2012-0100.html https://bugzilla.redhat.com/show_bug.cgi?id=759548 https://htcondor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=5e5571d1a431eb3c61977b6dd6ec90186ef79867 https://htcondor-wiki.cs.wisc.edu/index.cgi/chngview?cn=28264 https://htcondor-wiki.cs.wisc.edu/index.cgi/chngview?cn=28429 https://htcondor-wiki.cs.w • CWE-134: Use of Externally-Controlled Format String •