CVE编号
CVE-2012-3490利用情况
暂无补丁情况
N/A披露时间
2020-01-10漏洞描述
The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://condor-git.cs.wisc.edu/?p=condor.git;a=commitdiff;h=94e84ce4 | |
| http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html | |
| http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html | |
| http://www.openwall.com/lists/oss-security/2012/09/20/9 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3490 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | wisc | htcondor | * |
From (including) 7.6.0 |
Up to (excluding) 7.6.10 |
||||
| 运行在以下环境 | |||||||||
| 应用 | wisc | htcondor | * |
From (including) 7.8.0 |
Up to (excluding) 7.8.4 |
||||
- 攻击路径 网络
- 攻击复杂度 低
- 权限要求 低
- 影响范围 未更改
- 用户交互 无
- 可用性 高
- 保密性 高
- 完整性 高
还没有评论，来说两句吧...