Description
Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBS_O_HOST variable to the qsub program.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | torque | No fix yet | — |
| Ubuntu 14.04 LTS | torque | No fix yet | — |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=713090
- https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2011-2296
- [torqueusers] 20110809 TORQUE authorization security vulnerability mailing-list
- 49119 vdb-entry
- 45524 third-party-advisory
- torque-resource-manager-pbsohost-sec-bypass(69138) vdb-entry
- [oss-security] 20110810 CVE-2011-2907: authentication bypass in torque mailing-list