CVE-2012-3490

HIGH EPSS 87.9%
Published Jan 9, 20206y ago · Modified Jun 16, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Jan 9, 2020 6y ago
Last Modified Jun 16, 2026 2w ago

Description

The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
87.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Affected Products 2

VendorProductVersionRange
wischtcondor*≥7.6.0  –  <7.6.10
wischtcondor*≥7.8.0  –  <7.8.4

References 5

  • condor-git.cs.wisc.edu http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=94e84ce4
  • research.cs.wisc.edu http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html
    Release NotesThird Party Advisory
  • research.cs.wisc.edu http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
    Release NotesThird Party Advisory
  • openwall.com http://www.openwall.com/lists/oss-security/2012/09/20/9
    Mailing ListThird Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3490
    Issue TrackingThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.