CVE-2012-3493: Infoleak
Florian Weimer of the Red Hat Product Security Team found that an unauthenticated user able to connect to the Condor startd TCP port could request ads, provided they could guess or brute force the PID of the process, due to how the GIVEREQUESTAD handler is registered. The ads contains a lot of already-public information for users with READ privileges, however it also provides the ClaimId (as opposed to the PublicClaimId which truncates the full value of the ClaimID). If an attacker could obtain the private ClaimId, they could use it to control the running job, and also start new jobs on the system.
Other sources
The commandgiverequestad function in condorstartd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condorstartd port, which leaks the ClaimId.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3493?
CVE-2012-3493 has a medium severity due to the potential exposure of sensitive information to unauthenticated users.
How do I fix CVE-2012-3493?
To fix CVE-2012-3493, upgrade to Condor version 7.6.10 or 7.8.4 or higher.
What versions of Condor are affected by CVE-2012-3493?
CVE-2012-3493 affects Condor versions prior to 7.6.10 and versions prior to 7.8.4.
Is CVE-2012-3493 a remote vulnerability?
Yes, CVE-2012-3493 is a remote vulnerability as it can be exploited over a network through the Condor startd TCP port.
Who discovered CVE-2012-3493?
CVE-2012-3493 was discovered by Florian Weimer of the Red Hat Product Security Team.