CVE-2012-3490: Critical severity Wisc Htcondor vulnerability
The (1) mypopenvimpl and (2) myspawnv functions in src/condorutils/mypopen.cpp and the (3) systemCommand function in condorvm-gahp/vmgahpcommon.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3490?
CVE-2012-3490 is classified as a high-severity vulnerability due to improper return value checks on setuid calls.
How do I fix CVE-2012-3490?
To mitigate CVE-2012-3490, upgrade HTCondor to versions 7.6.10 or later, or 7.8.4 or later.
What types of systems are affected by CVE-2012-3490?
CVE-2012-3490 affects HTCondor versions prior to 7.6.10 and 7.8.4.
What functions are involved in CVE-2012-3490?
CVE-2012-3490 involves the my_popenv_impl, my_spawnv, and systemCommand functions.
What could be the consequence of exploiting CVE-2012-3490?
Exploitation of CVE-2012-3490 may allow unauthorized subprocess execution due to improper privilege management.