CVE-2013-4255: Input Validation
A denial of service flaw was found in the way Condor's policy definition evaluator processed certain policy definitions. If an administrator used an attribute defined on a job in any of the following condorstartd policies (CONTINUE, KILL, PREEMPT, SUSPEND), a remote Condor service user could use this flaw to cause a denial of the condorstartd service by submitting a Condor job that caused certain policy definition to be evaluated to either ERROR or UNDEFINED states.
Workaround: =========== Check for UNDEFINED & ERROR in the policy configuration.
Other sources
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANTVACATE, or (5) KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of service (condorstartd exit) via a crafted job.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4255?
CVE-2013-4255 has been classified as a high severity denial of service vulnerability.
How do I fix CVE-2013-4255?
To fix CVE-2013-4255, upgrade Condor to versions 8.0.1 or later, or apply the relevant patches provided by your vendor.
What systems are affected by CVE-2013-4255?
CVE-2013-4255 affects multiple versions of HTCondor and Red Hat Enterprise MRG including versions 7.5.4 through 8.0.0.
Can CVE-2013-4255 be exploited remotely?
Yes, CVE-2013-4255 can be exploited by remote users which could lead to a denial of service condition.
Are there any workarounds for CVE-2013-4255?
Currently, there are no official workarounds for CVE-2013-4255, and upgrading is the recommended course of action.