Description
Condor before 7.8.2 allows remote attackers to bypass host-based authentication and execute actions such as ALLOW_ADMINISTRATOR or ALLOW_WRITE by connecting from a system with a spoofed reverse DNS hostname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | condor | 7.8.2~dfsg.1-1 | — |
| Debian 13 | condor | 7.8.2~dfsg.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | condor +5 | 7.6.5-0.14.2.el5 | RHSA-2012:1169, RHSA-2012:1168 |
| Red Hat MRG 2 | condor-plumage +1 | 7.6.5-0.14.2.el6_3 | RHSA-2012:1169 |
Advisories 2
- RHSA-2012:1169 Red Hat Security Advisory: condor security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1168 Red Hat Security Advisory: condor security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- condor-reverse-dns-security-bypass(77748) vdb-entry
- RHSA-2012:1168 vendor-advisory
- 1027395 vdb-entry
- 84766 vdb-entry
- 50246 third-party-advisory
- 55032 vdb-entry
- 50294 third-party-advisory
- RHSA-2012:1169 vendor-advisory
- http://research.cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2012-0002.html