Updated condor packages that fix one security issue are now available forRed Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 5.Red Hat Product Security has rated this update as having Important securityimpact. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available from the CVE link in theReferences section.

HTCondor is a specialized workload management system for compute-intensivejobs. It provides a job queuing mechanism, scheduling policy, priorityscheme, and resource monitoring and management.The HTCondor scheduler can optionally notify a user of completed jobs bysending an email. Due to the way the daemon sent the email message,authenticated users able to submit jobs could execute arbitrary code withthe privileges of the condor user. (CVE-2014-8126)This issue was discovered by Florian Weimer of Red Hat Product Security.All Red Hat Enterprise MRG 2.5 users are advised to upgrade to theseupdated packages, which contain a backported patch to correct this issue.HTCondor must be restarted for the update to take effect.
Before applying this update, make sure all previously released erratarelevant to your system have been applied.This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/articles/11258Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 5)

SRPMS:
condor-7.8.9-0.11.el5.src.rpm
    MD5: e045200b9a90345da9ee16ffd6ce47e2SHA-256: 966dd75f2abba9ea4c1831a3850b94021d71cd7d00f5a6fd58646cdd6e641fc6
 
IA-32:
condor-7.8.9-0.11.el5.i386.rpm
    MD5: ad6db4bc3318f7d5c54c0ead744e0b3dSHA-256: d983f1f56f3afeacb4f7d4a198fcc929188d9dc20e74fca8ecdf3238e667f54b
condor-aviary-7.8.9-0.11.el5.i386.rpm
    MD5: c70ebdcffe93501e088b9aa310292fefSHA-256: 0059989e34d5b54e89be6fb93c16d0e5a18f78eee52ea29ea38f23a4b5215b0b
condor-classads-7.8.9-0.11.el5.i386.rpm
    MD5: 37d8ef9968eddeaaec2bc2484e748976SHA-256: 5fbd843b5b6ebe5764ee36ecb4eccf82a458f5ea4c9675bbd1a2b55953c86dea
condor-kbdd-7.8.9-0.11.el5.i386.rpm
    MD5: 13e0fc397eeb8d24119dd01e16d8459aSHA-256: 6b83bbf8d871b805af36dc73513fd1f2a00f915113263f6ff4a6e44d8e0d0272
condor-qmf-7.8.9-0.11.el5.i386.rpm
    MD5: fb503974bad64f9ec3c9f791ff462321SHA-256: 5fb65a1b7d5fa96a25553e5bf4b53cfacf30122e597edb5b4031d7227a898ab5
condor-vm-gahp-7.8.9-0.11.el5.i386.rpm
    MD5: 08d5ac835648b02c0a9befdf437da795SHA-256: 4a97f151e76364d6ca2dc6c00cc9ceec9bd211be93c9a7085cb7c93f52ac42cf
 
x86_64:
condor-7.8.9-0.11.el5.x86_64.rpm
    MD5: b36dfeb29c42cd3dfe641d57cefd50fbSHA-256: c7751941d4efe592d37ed9acba3da1ee30a74db21049cd7518f43fd55e618a0b
condor-aviary-7.8.9-0.11.el5.x86_64.rpm
    MD5: 1a13dde8f391939b27e25eb59ebf1b99SHA-256: ff81b7bad39b1571cd1598780ac5817a988774b417fe82035a5b7e192a6d52a1
condor-classads-7.8.9-0.11.el5.x86_64.rpm
    MD5: 306071b6a62ac4c52569aa1bbaeeb658SHA-256: 77b1ffc45cfd75f5d56870592898589f5dca088432531b7ee8bed724751cf7ee
condor-kbdd-7.8.9-0.11.el5.x86_64.rpm
    MD5: 3dfe8cc0f215b13f496d2de55fcc0f21SHA-256: 075dfb2cddfb2e99a33331c8db234447d6ad472fcbe4520ea14cef17dafed9d1
condor-qmf-7.8.9-0.11.el5.x86_64.rpm
    MD5: f6780a9d82de58bd807b91effc824f8bSHA-256: ffd9a1db78a58959ffaa4763772e22eaf457e9b7b408864d06c7f9d17a61f6bc
condor-vm-gahp-7.8.9-0.11.el5.x86_64.rpm
    MD5: 15b2600806ad5ad6da4b63be40fc578eSHA-256: cf20754172933daebe8012289bee6332f486dfccbc6a8d6a8deb0059f83268e6
 
(The unlinked packages above are only available from the Red Hat Network)
1169800 – CVE-2014-8126 condor: mailx invocation enables code execution as condor user

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from:

Leave a Reply