[SECURITY] [DSA 2936-1] torque security update

2014-05-2309:19:39

lists.debian.org

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON

Debian Security Advisory DSA-2936-1 [email protected]
http://www.debian.org/security/ Salvatore Bonaccorso
May 23, 2014 http://www.debian.org/security/faq

Package : torque
CVE ID : CVE-2014-0749
Debian Bug : 748827

John Fitzpatrick from MWR Labs reported a stack-based buffer overflow
vulnerability in torque, a PBS-derived batch processing queueing system.
An unauthenticated remote attacker could exploit this flaw to execute
arbitrary code with root privileges.

For the oldstable distribution (squeeze), this problem has been fixed in
version 2.4.8+dfsg-9squeeze4.

For the stable distribution (wheezy), this problem has been fixed in
version 2.4.16+dfsg-1+deb7u3.

For the unstable distribution (sid), this problem has been fixed in
version 2.4.16+dfsg-1.4.

We recommend that you upgrade your torque packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6kfreebsd-amd64torque-mom< 2.4.8+dfsg-9squeeze4torque-mom_2.4.8+dfsg-9squeeze4_kfreebsd-amd64.deb
Debian6kfreebsd-i386torque-scheduler< 2.4.8+dfsg-9squeeze4torque-scheduler_2.4.8+dfsg-9squeeze4_kfreebsd-i386.deb
Debian7armeltorque-server< 2.4.16+dfsg-1+deb7u3torque-server_2.4.16+dfsg-1+deb7u3_armel.deb
Debian6ia64torque-client< 2.4.8+dfsg-9squeeze4torque-client_2.4.8+dfsg-9squeeze4_ia64.deb
Debian7ia64libtorque2< 2.4.16+dfsg-1+deb7u3libtorque2_2.4.16+dfsg-1+deb7u3_ia64.deb
Debian7kfreebsd-i386torque-client-x11< 2.4.16+dfsg-1+deb7u3torque-client-x11_2.4.16+dfsg-1+deb7u3_kfreebsd-i386.deb
Debian7armhftorque-pam< 2.4.16+dfsg-1+deb7u3torque-pam_2.4.16+dfsg-1+deb7u3_armhf.deb
Debian7powerpctorque-scheduler< 2.4.16+dfsg-1+deb7u3torque-scheduler_2.4.16+dfsg-1+deb7u3_powerpc.deb
Debian6i386libtorque2< 2.4.8+dfsg-9squeeze4libtorque2_2.4.8+dfsg-9squeeze4_i386.deb
Debian7s390torque-server< 2.4.16+dfsg-1+deb7u3torque-server_2.4.16+dfsg-1+deb7u3_s390.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	kfreebsd-amd64	torque-mom	< 2.4.8+dfsg-9squeeze4	torque-mom_2.4.8+dfsg-9squeeze4_kfreebsd-amd64.deb
Debian	6	kfreebsd-i386	torque-scheduler	< 2.4.8+dfsg-9squeeze4	torque-scheduler_2.4.8+dfsg-9squeeze4_kfreebsd-i386.deb
Debian	7	armel	torque-server	< 2.4.16+dfsg-1+deb7u3	torque-server_2.4.16+dfsg-1+deb7u3_armel.deb
Debian	6	ia64	torque-client	< 2.4.8+dfsg-9squeeze4	torque-client_2.4.8+dfsg-9squeeze4_ia64.deb
Debian	7	ia64	libtorque2	< 2.4.16+dfsg-1+deb7u3	libtorque2_2.4.16+dfsg-1+deb7u3_ia64.deb
Debian	7	kfreebsd-i386	torque-client-x11	< 2.4.16+dfsg-1+deb7u3	torque-client-x11_2.4.16+dfsg-1+deb7u3_kfreebsd-i386.deb
Debian	7	armhf	torque-pam	< 2.4.16+dfsg-1+deb7u3	torque-pam_2.4.16+dfsg-1+deb7u3_armhf.deb
Debian	7	powerpc	torque-scheduler	< 2.4.16+dfsg-1+deb7u3	torque-scheduler_2.4.16+dfsg-1+deb7u3_powerpc.deb
Debian	6	i386	libtorque2	< 2.4.8+dfsg-9squeeze4	libtorque2_2.4.8+dfsg-9squeeze4_i386.deb
Debian	7	s390	torque-server	< 2.4.16+dfsg-1+deb7u3	torque-server_2.4.16+dfsg-1+deb7u3_s390.deb