Skip to navigation

Security Advisory Moderate: condor security update

Advisory: RHSA-2009:1688-1
Type: Security Advisory
Severity: Moderate
Issued on: 2009-12-21
Last updated on: 2009-12-21
Affected Products: Red Hat Enterprise MRG v1 for Enterprise Linux AS (version 4)
Red Hat Enterprise MRG v1 for Enterprise Linux ES (version 4)
CVEs (cve.mitre.org): CVE-2009-4133

Details

Updated condor packages that fix one security issue are now available for
Red Hat Enterprise MRG 1.2 for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Condor is a specialized workload management system for compute-intensive
jobs. It provides a job queuing mechanism, scheduling policy, priority
scheme, and resource monitoring and management.

A flaw was found in the way Condor managed jobs. This could allow a user
that is authorized to submit jobs into Condor to queue a job as if it were
submitted by a different local user, potentially leading to unauthorized
access to that user's account. (CVE-2009-4133)

Note: Condor will not run jobs as root; therefore, this flaw cannot lead to
a compromise of the root user account.

All Red Hat Enterprise MRG 1.2 users are advised to upgrade to these
updated packages, which contain a backported patch to correct this issue.
Condor must be restarted for the update to take effect.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Red Hat Enterprise MRG v1 for Enterprise Linux AS (version 4)

IA-32:
condor-7.4.1-0.7.1.el4.i386.rpm
File outdated by:  RHBA-2011:0218
    MD5: 81a61dca88cf16b0bc6eaa53a2b3ec78
condor-kbdd-7.4.1-0.7.1.el4.i386.rpm
File outdated by:  RHBA-2011:0218
    MD5: 79a24a24be27e443a54a7e61349fb535
condor-qmf-plugins-7.4.1-0.7.1.el4.i386.rpm     MD5: 80f6445503167b1ac904a38bee0478e1
 
x86_64:
condor-7.4.1-0.7.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0218
    MD5: 05d8a9e840652e7bbe2ff88483b4cd1a
condor-kbdd-7.4.1-0.7.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0218
    MD5: bb58e3f3221fc241242911caaa8435f8
condor-qmf-plugins-7.4.1-0.7.1.el4.x86_64.rpm     MD5: 1ce80b170636fd060589759ef1a516f2
 
Red Hat Enterprise MRG v1 for Enterprise Linux ES (version 4)

IA-32:
condor-7.4.1-0.7.1.el4.i386.rpm
File outdated by:  RHBA-2011:0218
    MD5: 81a61dca88cf16b0bc6eaa53a2b3ec78
condor-kbdd-7.4.1-0.7.1.el4.i386.rpm
File outdated by:  RHBA-2011:0218
    MD5: 79a24a24be27e443a54a7e61349fb535
condor-qmf-plugins-7.4.1-0.7.1.el4.i386.rpm     MD5: 80f6445503167b1ac904a38bee0478e1
 
x86_64:
condor-7.4.1-0.7.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0218
    MD5: 05d8a9e840652e7bbe2ff88483b4cd1a
condor-kbdd-7.4.1-0.7.1.el4.x86_64.rpm
File outdated by:  RHBA-2011:0218
    MD5: bb58e3f3221fc241242911caaa8435f8
condor-qmf-plugins-7.4.1-0.7.1.el4.x86_64.rpm     MD5: 1ce80b170636fd060589759ef1a516f2
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

544371 - CVE-2009-4133 Condor: queue super user cannot drop privs


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/