Florian Weimer of the Red Hat Product Security Team discovered that the ability to abort a job in Condor only required WRITE authorization, instead of a combination of WRITE authorization and job ownership. This could allow an authenticated attacker to bypass intended restrictions and abort any idle job on the system.
Acknowledgements: This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
This issue has been addressed in following products: MRG for RHEL-5 v. 2 Via RHSA-2012:1278 https://rhn.redhat.com/errata/RHSA-2012-1278.html
This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2012:1281 https://rhn.redhat.com/errata/RHSA-2012-1281.html
Created condor tracking bugs for this issue Affects: fedora-all [bug 858867]
This has been resolved in upstream 7.6.10 and 7.8.4: https://lists.cs.wisc.edu/archive/condor-users/2012-September/msg00077.shtml
The upstream git commit is here: http://condor-git.cs.wisc.edu/?p=condor.git;a=commitdiff;h=1fff5d40