Vulnerability in Condor Project
CVE-2011-4930
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.4 (Medium). Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.006 (45.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 45.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Condor Project — versions 7.2.0, 7.2.1, 7.2.2
- Fedoraproject Fedora — versions 15, 16
- Red Hat Enterprise Mrg — versions 1.3, 2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- research.cs.wisc.edu/htcondor/security/vulnerabilities/CONDOR-2012-0001.html (Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi
- htcondor-wiki.cs.wisc.edu/index.cgi/chngview
- rhn.redhat.com/errata/RHSA-2012-0099.html (vendor-advisory)
- htcondor-git.cs.wisc.edu/
- htcondor-wiki.cs.wisc.edu/index.cgi/tktview
- htcondor-wiki.cs.wisc.edu/index.cgi/chngview
- rhn.redhat.com/errata/RHSA-2012-0100.html (vendor-advisory)
Frequently asked questions
- What is CVE-2011-4930?
- CVE-2011-4930 is a vulnerability in Condor Project, classified under Use of Externally-Controlled Format String. Published 2014-02-10.
- Is CVE-2011-4930 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.