Vulnerability Name:

CVE-2012-3459 (CCN-78738)

Assigned:2012-09-19
Published:2012-09-19
Updated:2021-07-15
Summary:Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.
CVSS v3 Severity:3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.9 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N)
3.6 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Bypass Security
References:Source: MISC
Type: UNKNOWN
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=846501

Source: MITRE
Type: CNA
CVE-2012-3459

Source: CCN
Type: Condor Web Site
9.3 Stable Release Series 7.8

Source: CCN
Type: RHSA-2012-1278
Moderate: Red Hat Enterprise MRG Grid 2.2 security update

Source: REDHAT
Type: Vendor Advisory
RHSA-2012:1278

Source: CCN
Type: RHSA-2012-1281
Moderate: Red Hat Enterprise MRG Grid 2.2 security update

Source: REDHAT
Type: Vendor Advisory
RHSA-2012:1281

Source: CCN
Type: SA50660
Cumin Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
50660

Source: CCN
Type: SA50666
Condor Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
50666

Source: CCN
Type: Cumin SVN Repository
Cumin

Source: CCN
Type: BID-55618
Cumin Multiple Remote Vulnerabilities

Source: BID
Type: UNKNOWN
55632

Source: CCN
Type: BID-55632
Condor Multiple Security Bypass Vulnerabilities

Source: CCN
Type: Red Hat Bugzilla Bug 846501
CVE-2012-3459 cumin: allows for editing internal Condor job attributes

Source: XF
Type: UNKNOWN
condor-job-attribute-sec-bypass(78738)

Source: CCN
Type: Cumin Web page
Cumin

Vulnerable Configuration:Configuration 1:
  • cpe:/a:trevor_mckay:cumin:*:*:*:*:*:*:*:* (Version <= 0.1.5192-4)
  • OR cpe:/a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5092-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5068-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5137-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5105-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5137-5:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5137-4:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5054-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5037-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5137-3:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5137-2:*:*:*:*:*:*:*
  • OR cpe:/a:trevor_mckay:cumin:0.1.5033-1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:condor_project:condor:7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:condor_project:condor:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:condor_project:condor:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:condor_project:condor:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:condor_project:condor:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:condor_project:condor:7.4.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    trevor_mckay cumin *
    trevor_mckay cumin 0.1.5098-2
    trevor_mckay cumin 0.1.5192-1
    redhat enterprise mrg 2.0
    trevor_mckay cumin 0.1.5092-1
    trevor_mckay cumin 0.1.5068-1
    trevor_mckay cumin 0.1.4794-1
    trevor_mckay cumin 0.1.4916-1
    trevor_mckay cumin 0.1.5137-1
    trevor_mckay cumin 0.1.5105-1
    trevor_mckay cumin 0.1.3160-1
    trevor_mckay cumin 0.1.4369-1
    trevor_mckay cumin 0.1.5137-5
    trevor_mckay cumin 0.1.5137-4
    trevor_mckay cumin 0.1.5054-1
    trevor_mckay cumin 0.1.5037-1
    trevor_mckay cumin 0.1.4410-2
    trevor_mckay cumin 0.1.4494-1
    trevor_mckay cumin 0.1.5137-3
    trevor_mckay cumin 0.1.5137-2
    trevor_mckay cumin 0.1.5033-1
    condor_project condor 7.0.0
    condor_project condor 7.0.1
    condor_project condor 7.0.2
    condor_project condor 7.0.3
    condor_project condor 7.0.4
    condor_project condor 7.4.1
    redhat enterprise linux 5
    redhat enterprise linux 6
    redhat enterprise mrg 2.0