CVE-2008-3424
published 2008-07-31CVE-2008-3424: Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in…
PriorityP340high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.65%
83.9th percentile
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| condor_project | condor | < 7.0.4 | 7.0.4 |
| debian | condor | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q7rw-ph4p-r6ch: Condor before 7
ghsa_unreviewed·2022-05-02
CVE-2008-3424 [HIGH] CWE-863 GHSA-q7rw-ph4p-r6ch: Condor before 7
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
Red Hat
condor: incorrect handling of wild cards in authorization lists
vendor_redhat·2008-07-23·CVSS 7.5
CVE-2008-3424 [HIGH] condor: incorrect handling of wild cards in authorization lists
condor: incorrect handling of wild cards in authorization lists
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
Debian
CVE-2008-3424: condor - Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_...
vendor_debian·2008·CVSS 7.5
CVE-2008-3424 [HIGH] CVE-2008-3424: condor - Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_...
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
Scope: local
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-2953 firefox: CPU consumption via malicious javascript
bugzilla·2009-08-24·CVSS 5.0
CVE-2009-2953 [MEDIUM] CVE-2009-2953 firefox: CPU consumption via malicious javascript
CVE-2009-2953 firefox: CPU consumption via malicious javascript
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2953 to
the following vulnerability:
Name: CVE-2009-2953
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2953
Assigned: 20090824
Reference: BUGTRAQ:20090821 DoS vulnerabilities in Mozilla Firefox, Internet Explorer and Chrome
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/506006/100/0/threaded
Reference: MISC: http://websecurity.com.ua/3424/
Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote
attackers to cause a denial of service (CPU consumption) via
JavaScript code with a long string value for the hash property (aka
location.hash), a related issue to CVE-2008-5715.
Bugzilla
CVE-2008-3424 condor: incorrect handling of wild cards in authorization lists
bugzilla·2008-07-31·CVSS 7.5
CVE-2008-3424 [HIGH] CVE-2008-3424 condor: incorrect handling of wild cards in authorization lists
CVE-2008-3424 condor: incorrect handling of wild cards in authorization lists
Condor upstream version 7.0.4 fixes following security issue (quoting upstream
release notes):
This release fixes a problem causing possible incorrect handling of wild
cards in authorization lists. Examples of the configuration variables that
specify authorization lists are
ALLOW_WRITE
DENY_WRITE
HOSTALLOW_WRITE
HOSTDENY_WRITE
If a configuration variable uses the asterisk character (*) in configuration
variables that specify the authorization policy, it is advisable to upgrade.
This is especially true for the use of wild cards in any DENY list, since
this problem could result in access being allowed, when it should have been
denied. This issue affects all previous versions of Condor.
References:
http://www.c
CWE
Incorrect Authorization
mitre_cwe
CWE-863 Incorrect Authorization
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Background: An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups al
CWE
Improper Authorization
mitre_cwe
CWE-285 Improper Authorization
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Background: An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups along with their
CWE
Missing Authorization
mitre_cwe
CWE-862 Missing Authorization
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Background: An access control list (ACL) represents who/what has permissions to a given object. Different operating systems implement (ACLs) in different ways. In UNIX, there are three types of permissions: read, write, and execute. Users are divided into three classes for file access: owner, group owner, and all other users where each class has a separate set of rights. In Windows NT, there are four basic types of permissions for files: "No access", "Read access", "Change access", and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list of users and groups along with their associated permissions.
http://secunia.com/advisories/31284http://secunia.com/advisories/31423http://secunia.com/advisories/31459http://www.cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html#sec:New-7-0-4http://www.redhat.com/support/errata/RHSA-2008-0814.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0816.htmlhttp://www.securityfocus.com/bid/30440http://www.securitytracker.com/id?1020646https://exchange.xforce.ibmcloud.com/vulnerabilities/44063https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00252.htmlhttp://secunia.com/advisories/31284http://secunia.com/advisories/31423http://secunia.com/advisories/31459http://www.cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html#sec:New-7-0-4http://www.redhat.com/support/errata/RHSA-2008-0814.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0816.htmlhttp://www.securityfocus.com/bid/30440http://www.securitytracker.com/id?1020646https://exchange.xforce.ibmcloud.com/vulnerabilities/44063https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00252.html
2008-07-31
Published