Bug 894481 (CVE-2012-5390) - CVE-2012-5390 condor: privilege escalation via jobs submitted to the standard universe (CONDOR-2012-0003)
Summary: CVE-2012-5390 condor: privilege escalation via jobs submitted to the standard...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2012-5390
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-11 20:56 UTC by Vincent Danen
Modified: 2021-02-17 08:11 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-01-11 20:59:39 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Vincent Danen 2013-01-11 20:56:10 UTC 
As per the upstream advisory:

Condor installations that support Standard Universe jobs and run the daemons on the submit machine as root are vulnerable to local privilege escalation. If a user submits a job into the standard universe, the user job may then execute code on the submit machine as the root user. If your Condor installation does not contain the condor_shadow.std executable, then you are not affected by this vulnerability

The problem exists in the 7.8.X series only.  The 7.6.X series is not affected.  Also, Condor must be started as root otherwise it is not affected.

Current Fedora versions have the fixed version so are not affected.  Red Hat Enterprise MRG provides 7.6.x and is not affected.


Statement:

Not vulnerable. This issue did not affect the versions of condor as shipped with Red Hat Enterprise MRG 1 or 2 as they do not provide a vulnerable version of condor.


External References:

http://research.cs.wisc.edu/htcondor/security/vulnerabilities/CONDOR-2012-0003.html
Note You need to log in before you can comment on or make changes to this bug.