10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.016 Low
EPSS
Percentile
87.2%
Debian Security Advisory DSA-2796-1 [email protected]
http://www.debian.org/security/ Salvatore Bonaccorso
November 13, 2013 http://www.debian.org/security/faq
Package : torque
Vulnerability : arbitrary code execution
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-4495
Debian Bug : 729333
Matt Ezell from Oak Ridge National Labs reported a vulnerability in
torque, a PBS-derived batch processing queueing system.
A user could submit executable shell commands on the tail of what is
passed with the -M switch for qsub. This was later passed to a pipe,
making it possible for these commands to be executed as root on the
pbs_server.
For the oldstable distribution (squeeze), this problem has been fixed in
version 2.4.8+dfsg-9squeeze3.
For the stable distribution (wheezy), this problem has been fixed in
version 2.4.16+dfsg-1+deb7u2.
For the unstable distribution (sid), this problem has been fixed in
version 2.4.16+dfsg-1.3.
We recommend that you upgrade your torque packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | armel | torque-server | < 2.4.16+dfsg-1+deb7u2 | torque-server_2.4.16+dfsg-1+deb7u2_armel.deb |
Debian | 7 | s390 | torque-server | < 2.4.16+dfsg-1+deb7u2 | torque-server_2.4.16+dfsg-1+deb7u2_s390.deb |
Debian | 7 | s390x | libtorque2-dev | < 2.4.16+dfsg-1+deb7u2 | libtorque2-dev_2.4.16+dfsg-1+deb7u2_s390x.deb |
Debian | 7 | sparc | torque-mom | < 2.4.16+dfsg-1+deb7u2 | torque-mom_2.4.16+dfsg-1+deb7u2_sparc.deb |
Debian | 6 | s390 | torque-pam | < 2.4.8+dfsg-9squeeze3 | torque-pam_2.4.8+dfsg-9squeeze3_s390.deb |
Debian | 6 | sparc | torque-client-x11 | < 2.4.8+dfsg-9squeeze3 | torque-client-x11_2.4.8+dfsg-9squeeze3_sparc.deb |
Debian | 6 | kfreebsd-i386 | torque-server | < 2.4.8+dfsg-9squeeze3 | torque-server_2.4.8+dfsg-9squeeze3_kfreebsd-i386.deb |
Debian | 7 | mips | torque-client-x11 | < 2.4.16+dfsg-1+deb7u2 | torque-client-x11_2.4.16+dfsg-1+deb7u2_mips.deb |
Debian | 6 | mips | torque-client-x11 | < 2.4.8+dfsg-9squeeze3 | torque-client-x11_2.4.8+dfsg-9squeeze3_mips.deb |
Debian | 7 | i386 | libtorque2-dev | < 2.4.16+dfsg-1+deb7u2 | libtorque2-dev_2.4.16+dfsg-1+deb7u2_i386.deb |