CVE-2012-3459
published 2012-09-28CVE-2012-3459: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and…
PriorityP426medium4.9CVSS 2.0
AVNACMAuSCPIPAN
EPSS
1.57%
72.6th percentile
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_mrg | — | — |
| trevor_mckay | cumin | <= 0.1.5192-4 | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v57j-74hq-r78j: Cumin before 0
ghsa_unreviewed·2022-05-13
CVE-2012-3459 [MEDIUM] GHSA-v57j-74hq-r78j: Cumin before 0
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.
Red Hat
cumin: allows for editing internal Condor job attributes
vendor_redhat·2012-09-19·CVSS 4.9
CVE-2012-3459 [MEDIUM] cumin: allows for editing internal Condor job attributes
cumin: allows for editing internal Condor job attributes
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.
Package: cumin (Red Hat Enterprise MRG 1) - Will not fix
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
bugzilla·2012-09-19·CVSS 5.0
CVE-2012-2680 [MEDIUM] CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submiss
Bugzilla
CVE-2012-3459 cumin: allows for editing internal Condor job attributes
bugzilla·2012-08-08·CVSS 4.9
CVE-2012-3459 [MEDIUM] CVE-2012-3459 cumin: allows for editing internal Condor job attributes
CVE-2012-3459 cumin: allows for editing internal Condor job attributes
Florian Weimer reported that authenticated users could instruct Cumin to submit a job attribute change to Condor, simply be submitting a crafted POST request with certain additional parameters. This job could be used to change internal Condor attributes, including the Owner attribute, allowing Cumin users to elevate their privileges.
Discussion:
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
---
This issue has been addressed in following products:
MRG for RHEL-5 v. 2
Via RHSA-2012:1278 https://rhn.redhat.com/errata/RHSA-2012-1278.html
---
This issue has been addressed in following products:
MRG for RHEL-6 v.2
Via RHSA-2012:1281 https://rhn.redhat.com/errat
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=846501http://rhn.redhat.com/errata/RHSA-2012-1278.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1281.htmlhttp://secunia.com/advisories/50660http://secunia.com/advisories/50666http://www.securityfocus.com/bid/55632http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=846501http://rhn.redhat.com/errata/RHSA-2012-1278.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1281.htmlhttp://secunia.com/advisories/50660http://secunia.com/advisories/50666http://www.securityfocus.com/bid/55632
2012-09-28
Published