CVE-2010-3380: Medium severity schedmd slurm vulnerability
Published Sep 29, 2010
·Updated
The (1) init.d/slurm and (2) init.d/slurmdbd scripts in SLURM before 2.1.14 place the . (dot) directory in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Affected Software
29 affected components
llnl SLURM=2.0.9
llnl SLURM=2.0.3
llnl SLURM=1.3.15
llnl SLURM=2.1.11
llnl SLURM=2.0.5
llnl SLURM=2.1.1
llnl SLURM=2.0.8
llnl SLURM=2.1.9
llnl SLURM<=2.1.13
llnl SLURM=1.3.12
llnl SLURM=2.1.6
llnl SLURM=2.0.0
llnl SLURM=2.0.6
llnl SLURM=1.3.10
llnl SLURM=2.1.4
llnl SLURM=2.1.8
llnl SLURM=2.1.2
llnl SLURM=2.0.4
llnl SLURM=2.1.5
llnl SLURM=1.3.14
llnl SLURM=2.1.10
llnl SLURM=1.3.11
llnl SLURM=2.0.2
llnl SLURM=2.1.0
llnl SLURM=2.0.7
llnl SLURM=2.1.12
llnl SLURM=1.3.13
llnl SLURM=2.0.1
llnl SLURM=2.1.7
Event History
Sep 29, 2010
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-3380?
CVE-2010-3380 has a severity rating of medium due to its potential to allow privilege escalation via a Trojan horse shared library.
2
How do I fix CVE-2010-3380?
To fix CVE-2010-3380, upgrade to SLURM version 2.1.14 or later which addresses this vulnerability.
3
Who is affected by CVE-2010-3380?
CVE-2010-3380 affects SLURM versions prior to 2.1.14, specifically versions from 1.3.10 to 2.1.13.
4
What type of vulnerability is CVE-2010-3380?
CVE-2010-3380 is a local privilege escalation vulnerability caused by improper handling of the LD_LIBRARY_PATH.
5
Can CVE-2010-3380 be exploited remotely?
No, CVE-2010-3380 requires local access to the system for exploitation.