Description
The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | condor | 7.8.2~dfsg.1-1+deb7u1 | — |
| Debian 13 | condor | 7.8.2~dfsg.1-1+deb7u1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | condor +5 | 7.6.5-0.22.el5 | RHSA-2012:1281, RHSA-2012:1278 |
| Red Hat MRG 2 | condor-plumage +2 | 7.6.5-0.22.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | condor-wallaby +3 | 4.1.3-1.el5 | RHSA-2012:1281, RHSA-2012:1278 |
| Red Hat MRG 2 | condor-wallaby-base-db | 1.23-1.el5 | RHSA-2012:1281, RHSA-2012:1278 |
| Red Hat MRG 2 | cumin | 0.1.5444-3.el5 | RHSA-2012:1281, RHSA-2012:1278 |
| Red Hat MRG 2 | deltacloud-core +2 | 0.5.0-10.el6_2 | RHSA-2012:1281 |
| Red Hat MRG 2 | libdeltacloud +1 | 0.9-1.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | ruby-hpricot +2 | 0.8.4-2.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | ruby-json +1 | 1.4.6-10.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | ruby-nokogiri +2 | 1.5.0-0.8.beta4.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-daemons | 1.1.4-2.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-eventmachine | 0.12.10-7.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-fssm | 0.2.7-1.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-haml | 3.1.2-2.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-maruku | 0.6.0-4.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-mime-types +1 | 1.16-4.el6_0 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-mocha | 0.9.7-4.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-net-ssh +1 | 2.0.23-6.el6_0 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-rack | 1:1.3.0-2.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-rack-accept +1 | 0.4.3-6.el6_0 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-rack-test | 0.6.1-1.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-rake | 0.8.7-2.1.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-rest-client | 1.6.1-2.el6_0 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-sass +1 | 3.1.4-4.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-sinatra | 1:1.2.6-2.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-syntax | 1.0.0-4.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-thin +1 | 1.2.11-3.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-tilt +1 | 1.3.2-3.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygem-yard | 0.7.2-1.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | rubygems | 1.8.16-1.el6 | RHSA-2012:1281 |
| Red Hat MRG 2 | sesame | 1.0-4.el5 | RHSA-2012:1281, RHSA-2012:1278 |
| Red Hat MRG 2 | wallaby +3 | 0.12.5-10.el5 | RHSA-2012:1281, RHSA-2012:1278 |
Advisories 2
- RHSA-2012:1281 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.2 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1278 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.2 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 55632 vdb-entry
- RHSA-2012:1278 vendor-advisory
- http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
- http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=1db67805
- RHSA-2012:1281 vendor-advisory
- 50666 third-party-advisory
- [oss-security] 20120920 Notification of upstream Condor security fixes mailing-list
- http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3492