Description
Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job attribute.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | condor +2 | 7.4.1-0.7.1.el4 | RHSA-2009:1689, RHSA-2009:1688 |
| Red Hat MRG 1 | condor-vm-gahp | 7.4.1-0.7.1.el5 | RHSA-2009:1689 |
Advisories 2
- RHSA-2009:1688 Red Hat Security Advisory: condor security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2009:1689 Red Hat Security Advisory: condor security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- RHSA-2009:1689 vendor-advisory
- condor-jobs-security-bypass(54984) vdb-entry
- 37766 third-party-advisory
- RHSA-2009:1688 vendor-advisory
- 1023378 vdb-entry
- 37443 vdb-entry
- http://condor-wiki.cs.wisc.edu/index.cgi/tktview?tn=1018
- http://www.cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2009-0001.html
- https://bugzilla.redhat.com/show_bug.cgi?id=544371
- 37803 third-party-advisory
- http://www.cs.wisc.edu/condor/manual/v7.4/8_3Stable_Release.html#SECTION00931000000000000000