Description
pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | torque | 2.4.16+dfsg-1+deb7u1 | DSA-2770-1 |
| Debian 6.0 | torque | 2.4.8+dfsg-9squeeze2 | DSA-2770-1 |
Advisories 1
- DSA-2770-1 torque - authentication bypass Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20130909 Re: CVE request: Torque privilege escalation mailing-list
- DSA-2770 vendor-advisory
- [torqueusers] 20130906 security advisory mailing-list
- [oss-security] 20130909 CVE request: Torque privilege escalation mailing-list