VulnerabilityModified
CVE-2008-3830
Condor before 7.0.5 does not properly handle when the configuration specifies overlapping netmasks in allow or deny rules, which causes the rule to be ignored and allows attackers to bypass intended access restrictions.
HIGH 7.2EPSS 0.39%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Condor before 7.0.5 does not properly handle when the configuration specifies overlapping netmasks in allow or deny rules, which causes the rule to be ignored and allows attackers to bypass intended access restrictions.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.39% probability · 32th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- condor project/condor
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/32189Vendor Advisory
- http://secunia.com/advisories/32193
- http://secunia.com/advisories/32232
- http://www.cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html#SECTION00931000000000000000Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0911.html
- http://www.redhat.com/support/errata/RHSA-2008-0924.html
- http://www.securityfocus.com/bid/31621
- http://www.securitytracker.com/id?1021002
- http://www.vupen.com/english/advisories/2008/2760
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00264.html
- http://secunia.com/advisories/32189Vendor Advisory
- http://secunia.com/advisories/32193
- http://secunia.com/advisories/32232
- http://www.cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html#SECTION00931000000000000000Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0911.html
- http://www.redhat.com/support/errata/RHSA-2008-0924.html
- http://www.securityfocus.com/bid/31621
- http://www.securitytracker.com/id?1021002
- http://www.vupen.com/english/advisories/2008/2760
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00264.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.