CVE-2012-3492: Medium severity htcondor vulnerability

Published Sep 28, 2012

Updated

The filesystem authentication (condorio/condorauthfs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.

Affected Software

14 affected components

Condor Project Condor=7.6.0

Condor Project Condor=7.6.1

Condor Project Condor=7.6.2

Condor Project Condor=7.6.3

Condor Project Condor=7.6.4

Condor Project Condor=7.6.5

Condor Project Condor=7.6.6

Condor Project Condor=7.6.7

Condor Project Condor=7.6.8

Condor Project Condor=7.6.9

Condor Project Condor=7.8.0

Condor Project Condor=7.8.1

Condor Project Condor=7.8.2

Condor Project Condor=7.8.3

Remediation

Patch Available

http://condor-git.cs.wisc.edu/?p=condor.git;a=commitdiff;h=1db67805

Event History

Sep 28, 2012

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-3492?

CVE-2012-3492 is considered a medium severity vulnerability due to the potential for user impersonation.

How do I fix CVE-2012-3492?

To fix CVE-2012-3492, upgrade to Condor version 7.6.10 or 7.8.4 or later.

What versions are affected by CVE-2012-3492?

CVE-2012-3492 affects Condor versions 7.6.0 through 7.6.9 and 7.8.0 through 7.8.3.

What type of attack does CVE-2012-3492 allow?

CVE-2012-3492 allows remote attackers to impersonate users by leveraging weak permissions on authentication directories.

Where can I find more information about CVE-2012-3492?

More information about CVE-2012-3492 can typically be found in the release notes for Condor software.