TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories.
{"fedora": [{"lastseen": "2020-12-21T08:17:52", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2014-10-18T16:59:37", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: torque-3.0.4-6.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2014-10-18T16:59:37", "id": "FEDORA:B3AE960EE948", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YR52BGTQI6L334FPWDPFQKJAXHQYKWFK/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2015-05-30T15:45:09", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: torque-4.2.10-3.fc22", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495", "CVE-2014-3684"], "modified": "2015-05-30T15:45:09", "id": "FEDORA:4C5B6625E4A0", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JGXDACWNM4NXQWHHLSFV5W4BWUJIRXYS/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2015-05-30T15:54:27", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: torque-4.2.10-3.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495", "CVE-2014-3684"], "modified": "2015-05-30T15:54:27", "id": "FEDORA:1F9DD604B1B8", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DOEYNN7POF6BZSK3D5L64FUKWHBQDJIA/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2015-05-30T15:42:35", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: torque-4.2.10-3.fc21", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495", "CVE-2014-3684"], "modified": "2015-05-30T15:42:35", "id": "FEDORA:1CC4D625D8BB", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/22T2AZVWHIX2Z2DPPT324FX4JLUSS7YO/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2014-09-23T04:46:33", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: torque-4.2.8-1.fc21", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2014-09-23T04:46:33", "id": "FEDORA:AFE5F20BD5", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OAY4YP7IJSEFSK2WNSLJGSXARLPAV3ZA/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:37:25", "description": "Check the version of torque", "cvss3": {}, "published": "2014-10-19T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2014-11989", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868411", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868411", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2014-11989\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868411\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-10-19 05:57:35 +0200 (Sun, 19 Oct 2014)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Update for torque FEDORA-2014-11989\");\n script_tag(name:\"summary\", value:\"Check the version of torque\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-11989\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141123.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~3.0.4~6.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:37:37", "description": "Check the version of torque", "cvss3": {}, "published": "2014-10-19T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2014-12059", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868413", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868413", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2014-12059\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868413\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-10-19 05:57:39 +0200 (Sun, 19 Oct 2014)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Update for torque FEDORA-2014-12059\");\n script_tag(name:\"summary\", value:\"Check the version of torque\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-12059\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141126.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~3.0.4~5.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:26", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-06-09T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2015-8571", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3684", "CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869424", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869424", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2015-8571\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869424\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-06-09 10:55:33 +0200 (Tue, 09 Jun 2015)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-3684\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for torque FEDORA-2015-8571\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-8571\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/159183.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~4.2.10~3.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:33", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-07-07T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2015-8544", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3684", "CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869691", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869691", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2015-8544\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869691\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-07 06:35:05 +0200 (Tue, 07 Jul 2015)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-3684\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for torque FEDORA-2015-8544\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 22\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-8544\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/159201.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC22\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~4.2.10~3.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:21", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-06-09T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2015-8577", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3684", "CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869399", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869399", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2015-8577\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869399\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-06-09 10:51:16 +0200 (Tue, 09 Jun 2015)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-3684\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for torque FEDORA-2015-8577\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-8577\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/159259.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~4.2.10~3.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-24T12:52:00", "description": "John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.", "cvss3": {}, "published": "2013-10-09T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2770-1 (torque - authentication bypass)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892770", "href": "http://plugins.openvas.org/nasl.php?oid=892770", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2770.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2770-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"torque on Debian Linux\";\ntag_insight = \"The TORQUE server dispatches jobs across physically separated machines. It\nmay also be beneficial for single machines to organise the sequential execution\nof multiple jobs.\";\ntag_solution = \"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\";\ntag_summary = \"John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892770);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-4319\");\n script_name(\"Debian Security Advisory DSA 2770-1 (torque - authentication bypass)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-10-09 00:00:00 +0200 (Wed, 09 Oct 2013)\");\n script_tag(name: \"cvss_base\", value:\"9.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2770.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:15", "description": "John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.", "cvss3": {}, "published": "2013-10-09T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2770-1 (torque - authentication bypass)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310892770", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892770", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2770.nasl 14276 2019-03-18 14:43:56Z cfischer $\n# Auto-generated from advisory DSA 2770-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892770\");\n script_version(\"$Revision: 14276 $\");\n script_cve_id(\"CVE-2013-4319\");\n script_name(\"Debian Security Advisory DSA 2770-1 (torque - authentication bypass)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:43:56 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-09 00:00:00 +0200 (Wed, 09 Oct 2013)\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2770.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_tag(name:\"affected\", value:\"torque on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\");\n script_tag(name:\"summary\", value:\"John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2017-07-24T12:51:51", "description": "Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.", "cvss3": {}, "published": "2013-11-13T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892796", "href": "http://plugins.openvas.org/nasl.php?oid=892796", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2796.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2796-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"torque on Debian Linux\";\ntag_insight = \"The TORQUE server dispatches jobs across physically separated machines. It\nmay also be beneficial for single machines to organise the sequential execution\nof multiple jobs.\";\ntag_solution = \"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\";\ntag_summary = \"Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892796);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-4495\");\n script_name(\"Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-11-13 00:00:00 +0100 (Wed, 13 Nov 2013)\");\n script_tag(name: \"cvss_base\", value:\"10.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2796.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:25", "description": "Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.", "cvss3": {}, "published": "2013-11-13T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310892796", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892796", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2796.nasl 14276 2019-03-18 14:43:56Z cfischer $\n# Auto-generated from advisory DSA 2796-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892796\");\n script_version(\"$Revision: 14276 $\");\n script_cve_id(\"CVE-2013-4495\");\n script_name(\"Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:43:56 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-11-13 00:00:00 +0100 (Wed, 13 Nov 2013)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2796.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_tag(name:\"affected\", value:\"torque on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\");\n script_tag(name:\"summary\", value:\"Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:08", "description": "Gentoo Linux Local Security Checks GLSA 201412-47", "cvss3": {}, "published": "2015-09-29T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201412-47", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4925", "CVE-2013-4319", "CVE-2011-2907", "CVE-2013-4495", "CVE-2014-0749", "CVE-2011-2193"], "modified": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310121333", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121333", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa-201412-47.nasl 12128 2018-10-26 13:35:25Z cfischer $\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121333\");\n script_version(\"$Revision: 12128 $\");\n script_tag(name:\"creation_date\", value:\"2015-09-29 11:28:24 +0300 (Tue, 29 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 15:35:25 +0200 (Fri, 26 Oct 2018) $\");\n script_name(\"Gentoo Security Advisory GLSA 201412-47\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201412-47\");\n script_cve_id(\"CVE-2011-2193\", \"CVE-2011-2907\", \"CVE-2011-4925\", \"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-0749\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks GLSA 201412-47\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"sys-cluster/torque\", unaffected: make_list(\"ge 4.1.7\"), vulnerable: make_list() )) != NULL) {\n\n report += res;\n}\nif((res=ispkgvuln(pkg:\"sys-cluster/torque\", unaffected: make_list(\"ge 2.5.13\"), vulnerable: make_list() )) != NULL) {\n\n report += res;\n}\nif((res=ispkgvuln(pkg:\"sys-cluster/torque\", unaffected: make_list(), vulnerable: make_list(\"lt 4.1.7\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2021-06-08T19:14:15", "description": "It's possible to queue code execution by connecting directly to pbs_mom port. Shell characters vulnerability.", "cvss3": {}, "published": "2013-11-18T00:00:00", "type": "securityvulns", "title": "torque authentication bypass", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2013-11-18T00:00:00", "id": "SECURITYVULNS:VULN:13367", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13367", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:49", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2770-1 security@debian.org\r\nhttp://www.debian.org/security/ Salvatore Bonaccorso\r\nOctober 09, 2013 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : torque\r\nVulnerability : authentication bypass\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2013-4319\r\nDebian Bug : 722306\r\n\r\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\r\nvulnerability in torque, a PBS-derived batch processing queueing system.\r\n\r\nThe torque authentication model revolves around the use of privileged\r\nports. If a request is not made from a privileged port then it is\r\nassumed not to be trusted or authenticated. It was found that pbs_mom\r\ndoes not perform a check to ensure that connections are established\r\nfrom a privileged port.\r\n\r\nA user who can run jobs or login to a node running pbs_server or pbs_mom\r\ncan exploit this vulnerability to remotely execute code as root on the\r\ncluster by submitting a command directly to a pbs_mom daemon\r\nto queue and run a job.\r\n\r\nFor the oldstable distribution (squeeze), this problem has been fixed in\r\nversion 2.4.8+dfsg-9squeeze2.\r\n\r\nFor the stable distribution (wheezy), this problem has been fixed in\r\nversion 2.4.16+dfsg-1+deb7u1.\r\n\r\nFor the unstable distribution (sid), this problem will be fixed soon.\r\n\r\nWe recommend that you upgrade your torque packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.14 (GNU/Linux)\r\n\r\niQIcBAEBCgAGBQJSVWfFAAoJEAVMuPMTQ89E6Z8P/20uNyrICGD4ut8gjo9SN91S\r\nrCH5IfPwaIqS9cwZBkoqlRKxSc54d5eO7dlSGeOEpuB5KExYHi/h9KmS/Ja31pUO\r\nnCZ9onijhiyIr7d1+7YIVQpBXA7E3QxDXC5462ZtCuM9OPwFO22yspQKq9TfI2U+\r\nhAhuRPnb6J7+7i8WQubpOLGynhuy4EJaYBTNiL7i9Z/Na7iWKRTHioFb92y4Y/pT\r\nsFpQ1r5EMVDzmJ8UzmyrWbdWMumKKoiGzgBCan9UKtkX2l4i8wjmc3ypifox+1zo\r\nlJqoBXh0PFrRtyHYwFAAU2oujuNdxgTwBD9al7Jip/0FHtEbhGum1VwIx9t95JrZ\r\nPsrjWjXZWdydRQHflBoGj3pKxD0UPH+OcEWgXpR8gGsID0g17muKRIuztAwFtrbR\r\nyLOpV0sobzR5GWaBFfwbIf+zziljqNKhXe1DgAjjegUuWD9Y4HP0H2pb42bp5ybx\r\nL9avUTjn9GOz428cAuj2PBLPaBLrtlvXePgjk88sl+Gf6Dt1SWqtH5niFgQtwhfV\r\nXFwIG6zBhCJp6jW2CyZxXHMkWgOWTAIOTb7B4R77y8MTyAnK/Ua30x4DFAaF4qli\r\nARF6BsI3h6VjU835sDPJlaPHu+0KwM5Q7xOswuNtxyNYsuxVD2+ap+e0zIYlEod0\r\naO3eNNSfeTDJq1B2aD54\r\n=0S9S\r\n-----END PGP SIGNATURE-----\r\n\r\n", "cvss3": {}, "published": "2013-10-13T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2770-1] torque security update", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-13T00:00:00", "id": "SECURITYVULNS:DOC:29943", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29943", "sourceData": "", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:49", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2796-1 security@debian.org\r\nhttp://www.debian.org/security/ Salvatore Bonaccorso\r\nNovember 13, 2013 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : torque\r\nVulnerability : arbitrary code execution\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2013-4495\r\nDebian Bug : 729333\r\n\r\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\r\ntorque, a PBS-derived batch processing queueing system.\r\n\r\nA user could submit executable shell commands on the tail of what is\r\npassed with the -M switch for qsub. This was later passed to a pipe,\r\nmaking it possible for these commands to be executed as root on the\r\npbs_server.\r\n\r\nFor the oldstable distribution (squeeze), this problem has been fixed in\r\nversion 2.4.8+dfsg-9squeeze3.\r\n\r\nFor the stable distribution (wheezy), this problem has been fixed in\r\nversion 2.4.16+dfsg-1+deb7u2.\r\n\r\nFor the unstable distribution (sid), this problem has been fixed in\r\nversion 2.4.16+dfsg-1.3.\r\n\r\nWe recommend that you upgrade your torque packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.15 (GNU/Linux)\r\n\r\niQIcBAEBCgAGBQJSg9JgAAoJEAVMuPMTQ89EqOIP/Au7xN2tw30qBBOtnlyDxonv\r\nDqn5FxfAyxvsrBuD4uB4wOELNR8UiqHn1xWcRBLHTP5DJonhAHMH3VeCFJIjfj0a\r\nvUcnzu0SnChvrT1OaZEF7M7RzOzT03ylSKwA5ED6U7ZuXOPqWPSXI+hzDhjLuThf\r\nS6hrw4yAc9RI6uoMQIK5HHbPf8EwjhO+ep/cXPH7KizCw64xdpqBrkEqNvPS851C\r\nm7CjfiGp2nOMLcdr0MUA62P/tRn9PYcCrNLcVge+2TXAtZ4gWctCxd3iud4R8Abt\r\nEYnzv8uckW1/yhTyd4l2wc5U34Xbf6O6ZbuQwt9ZzF/s4XNCaX26BLcwTNWYYOmy\r\n+YnRW+QqBsiTXIS3W2uTW9w93iwgkP7t087tZx6enllxplqkkI8GNX7bWNXA2lcY\r\niQuCLfxzsNYkhNiGkuf4NgglUbcMEw4D8V4vuHoTAVSwemLLY2ghkwSCLW1ZUHTb\r\nwI0gDJPSFp10Z3CORSHJghFX5LH25HgrKDJ4S0Waz5WjBRT21r4Li/bsYHGOMht2\r\njAyQ3H1Ahfk4KK/IKu5V/q6UoYMtX5On2ozCfTdUa/fLvvQHzDj6zHLmWa+ob3Xg\r\nyH+T0Fsj+laxky1N+QeYnN2uMPiAsxKsR1RLvoZk2dniStdldkwR37Pmv9jlFjnf\r\nRFqk8VMbBlX9kb5qxPdq\r\n=z3T1\r\n-----END PGP SIGNATURE-----\r\n", "cvss3": {}, "published": "2013-11-18T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2796-1] torque security update", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-18T00:00:00", "id": "SECURITYVULNS:DOC:29996", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29996", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2023-05-18T14:24:11", "description": "Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752) Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2014-10-20T00:00:00", "type": "nessus", "title": "Fedora 20 : torque-3.0.4-6.fc20 (2014-11989)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-11989.NASL", "href": "https://www.tenable.com/plugins/nessus/78565", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-11989.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(78565);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_xref(name:\"FEDORA\", value:\"2014-11989\");\n\n script_name(english:\"Fedora 20 : torque-3.0.4-6.fc20 (2014-11989)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ\n#1029752) Fix CVE-2013-4495: arbitrary code execution via job\nsubmission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1005918\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141123.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?41ea24c5\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/10/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"torque-3.0.4-6.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:24:29", "description": "Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752) Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2014-10-20T00:00:00", "type": "nessus", "title": "Fedora 19 : torque-3.0.4-5.fc19 (2014-12059)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-12059.NASL", "href": "https://www.tenable.com/plugins/nessus/78566", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-12059.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(78566);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_bugtraq_id(62273);\n script_xref(name:\"FEDORA\", value:\"2014-12059\");\n\n script_name(english:\"Fedora 19 : torque-3.0.4-5.fc19 (2014-12059)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ\n#1029752) Fix CVE-2013-4495: arbitrary code execution via job\nsubmission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1005918\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141126.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e4acf9f6\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/10/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"torque-3.0.4-5.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-27T14:14:50", "description": "Updated torque package fixes security vulnerability :\n\nA non-priviledged user who was able to run jobs or login to a node which ran pbs_server or pbs_mom, could submit arbitrary jobs to a pbs_mom daemon to queue and run the job, which would run as root (CVE-2013-4319).", "cvss3": {}, "published": "2013-10-20T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : torque (MDVSA-2013:252)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64torque-devel", "p-cpe:/a:mandriva:linux:lib64torque2", "p-cpe:/a:mandriva:linux:torque", "p-cpe:/a:mandriva:linux:torque-client", "p-cpe:/a:mandriva:linux:torque-gui", "p-cpe:/a:mandriva:linux:torque-mom", "p-cpe:/a:mandriva:linux:torque-sched", "p-cpe:/a:mandriva:linux:torque-server", "cpe:/o:mandriva:business_server:1"], "id": "MANDRIVA_MDVSA-2013-252.NASL", "href": "https://www.tenable.com/plugins/nessus/70519", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:252. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70519);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_bugtraq_id(62273);\n script_xref(name:\"MDVSA\", value:\"2013:252\");\n\n script_name(english:\"Mandriva Linux Security Advisory : torque (MDVSA-2013:252)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated torque package fixes security vulnerability :\n\nA non-priviledged user who was able to run jobs or login to a node\nwhich ran pbs_server or pbs_mom, could submit arbitrary jobs to a\npbs_mom daemon to queue and run the job, which would run as root\n(CVE-2013-4319).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2013-0308.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-gui\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-mom\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-sched\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque-devel-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque2-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-client-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-gui-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-mom-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-sched-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-server-4.1.5.1-1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-27T14:14:43", "description": "John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass vulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged ports. If a request is not made from a privileged port then it is assumed not to be trusted or authenticated. It was found that pbs_mom does not perform a check to ensure that connections are established from a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom can exploit this vulnerability to remotely execute code as root on the cluster by submitting a command directly to a pbs_mom daemon to queue and run a job.", "cvss3": {}, "published": "2013-10-10T00:00:00", "type": "nessus", "title": "Debian DSA-2770-1 : torque - authentication bypass", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:torque", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2770.NASL", "href": "https://www.tenable.com/plugins/nessus/70354", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2770. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70354);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_bugtraq_id(62273);\n script_xref(name:\"DSA\", value:\"2770\");\n\n script_name(english:\"Debian DSA-2770-1 : torque - authentication bypass\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"John Fitzpatrick of MWR InfoSecurity discovered an authentication\nbypass vulnerability in torque, a PBS-derived batch processing\nqueueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or\npbs_mom can exploit this vulnerability to remotely execute code as\nroot on the cluster by submitting a command directly to a pbs_mom\ndaemon to queue and run a job.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722306\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2770\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the torque packages.\n\nFor the oldstable distribution (squeeze), this problem has been fixed\nin version 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2-dev\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client-x11\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-common\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-mom\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-pam\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-scheduler\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-server\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2-dev\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client-x11\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-common\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-mom\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-pam\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-scheduler\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-server\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:24:35", "description": "Updated torque packages fix security vulnerability :\n\nA user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server (CVE-2013-4495).", "cvss3": {}, "published": "2013-11-20T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : torque (MDVSA-2013:268)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64torque-devel", "p-cpe:/a:mandriva:linux:lib64torque2", "p-cpe:/a:mandriva:linux:torque", "p-cpe:/a:mandriva:linux:torque-client", "p-cpe:/a:mandriva:linux:torque-gui", "p-cpe:/a:mandriva:linux:torque-mom", "p-cpe:/a:mandriva:linux:torque-sched", "p-cpe:/a:mandriva:linux:torque-server", "cpe:/o:mandriva:business_server:1"], "id": "MANDRIVA_MDVSA-2013-268.NASL", "href": "https://www.tenable.com/plugins/nessus/70968", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:268. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70968);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4495\");\n script_bugtraq_id(63722);\n script_xref(name:\"MDVSA\", value:\"2013:268\");\n\n script_name(english:\"Mandriva Linux Security Advisory : torque (MDVSA-2013:268)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated torque packages fix security vulnerability :\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server (CVE-2013-4495).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2013-0327.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-gui\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-mom\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-sched\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/11/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque-devel-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque2-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-client-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-gui-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-mom-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-sched-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-server-4.1.5.1-1.1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:24:35", "description": "Matt Ezell from Oak Ridge National Labs reported a vulnerability in torque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server.", "cvss3": {}, "published": "2013-11-21T00:00:00", "type": "nessus", "title": "Debian DSA-2796-1 : torque - arbitrary code execution", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:torque", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2796.NASL", "href": "https://www.tenable.com/plugins/nessus/70983", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2796. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70983);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4495\");\n script_xref(name:\"DSA\", value:\"2796\");\n\n script_name(english:\"Debian DSA-2796-1 : torque - arbitrary code execution\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2796\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the torque packages.\n\nFor the oldstable distribution (squeeze), this problem has been fixed\nin version 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/11/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2-dev\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client-x11\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-common\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-mom\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-pam\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-scheduler\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-server\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2-dev\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client-x11\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-common\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-mom\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-pam\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-scheduler\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-server\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-20T14:16:24", "description": "Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2014-09-23T00:00:00", "type": "nessus", "title": "Fedora 21 : torque-4.2.8-1.fc21 (2014-10153)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:21"], "id": "FEDORA_2014-10153.NASL", "href": "https://www.tenable.com/plugins/nessus/77783", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-10153.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(77783);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_bugtraq_id(63722);\n script_xref(name:\"FEDORA\", value:\"2014-10153\");\n\n script_name(english:\"Fedora 21 : torque-4.2.8-1.fc21 (2014-10153)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ\n#1029752)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=796154\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-September/138222.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?78f07173\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:H/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"torque-4.2.8-1.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:25:42", "description": "The remote host is affected by the vulnerability described in GLSA-201412-47 (TORQUE Resource Manager: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, or bypass security restrictions.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2014-12-29T00:00:00", "type": "nessus", "title": "GLSA-201412-47 : TORQUE Resource Manager: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193", "CVE-2011-2907", "CVE-2011-4925", "CVE-2013-4319", "CVE-2013-4495", "CVE-2014-0749"], "modified": "2021-01-06T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:torque"], "id": "GENTOO_GLSA-201412-47.NASL", "href": "https://www.tenable.com/plugins/nessus/80268", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201412-47.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80268);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-2193\", \"CVE-2011-2907\", \"CVE-2011-4925\", \"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-0749\");\n script_bugtraq_id(48374, 49119, 51224, 62273, 63722, 67420);\n script_xref(name:\"GLSA\", value:\"201412-47\");\n\n script_name(english:\"GLSA-201412-47 : TORQUE Resource Manager: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201412-47\n(TORQUE Resource Manager: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in TORQUE Resource\n Manager. Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A context-dependent attacker may be able to gain escalated privileges,\n execute arbitrary code, or bypass security restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201412-47\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All TORQUE Resource Manager 4.x users should upgrade to the latest\n version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=sys-cluster/torque-4.1.7'\n All TORQUE Resource Manager 2.x users should upgrade to the latest\n version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=sys-cluster/torque-2.5.13'\n NOTE: One or more of the issues described in this advisory have been\n fixed in previous updates. They are included in this advisory for the\n sake of completeness. It is likely that your system is already no longer\n affected by them.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:U/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/12/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"sys-cluster/torque\", unaffected:make_list(\"ge 4.1.7\", \"rge 2.5.13\"), vulnerable:make_list(\"lt 4.1.7\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"TORQUE Resource Manager\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "debian": [{"lastseen": "2021-10-21T23:38:56", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2770-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nOctober 09, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : authentication bypass\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4319\nDebian Bug : 722306\n\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-10-09T14:37:40", "type": "debian", "title": "[SECURITY] [DSA 2770-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-09T14:37:40", "id": "DEBIAN:DSA-2770-1:837E9", "href": "https://lists.debian.org/debian-security-announce/2013/msg00181.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-05-02T16:37:40", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2770-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nOctober 09, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : authentication bypass\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4319\nDebian Bug : 722306\n\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-10-09T14:37:40", "type": "debian", "title": "[SECURITY] [DSA 2770-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-09T14:37:40", "id": "DEBIAN:DSA-2770-1:26F96", "href": "https://lists.debian.org/debian-security-announce/2013/msg00181.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T23:26:01", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2796-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nNovember 13, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : arbitrary code execution\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4495\nDebian Bug : 729333\n\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-11-13T19:31:34", "type": "debian", "title": "[SECURITY] [DSA 2796-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-13T19:31:34", "id": "DEBIAN:DSA-2796-1:5F931", "href": "https://lists.debian.org/debian-security-announce/2013/msg00208.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-05-02T16:36:41", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2796-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nNovember 13, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : arbitrary code execution\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4495\nDebian Bug : 729333\n\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-11-13T19:31:34", "type": "debian", "title": "[SECURITY] [DSA 2796-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-13T19:31:34", "id": "DEBIAN:DSA-2796-1:98437", "href": "https://lists.debian.org/debian-security-announce/2013/msg00208.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "osv": [{"lastseen": "2022-08-10T07:06:05", "description": "\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs\\_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\n\nA user who can run jobs or login to a node running pbs\\_server or pbs\\_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs\\_mom daemon\nto queue and run a job.\n\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\n\nWe recommend that you upgrade your torque packages.\n\n\n", "cvss3": {}, "published": "2013-10-09T00:00:00", "type": "osv", "title": "torque - authentication bypass", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2022-08-10T07:06:02", "id": "OSV:DSA-2770-1", "href": "https://osv.dev/vulnerability/DSA-2770-1", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T07:09:08", "description": "\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs\\_server.\n\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\n\nWe recommend that you upgrade your torque packages.\n\n\n", "cvss3": {}, "published": "2013-11-13T00:00:00", "type": "osv", "title": "torque - arbitrary code execution", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2022-08-10T07:09:06", "id": "OSV:DSA-2796-1", "href": "https://osv.dev/vulnerability/DSA-2796-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "mageia": [{"lastseen": "2023-06-05T15:16:09", "description": "Updated torque package fixes security vulnerability: A non-priviledged user who was able to run jobs or login to a node which ran pbs_server or pbs_mom, could submit arbitrary jobs to a pbs_mom daemon to queue and run the job, which would run as root (CVE-2013-4319). \n", "cvss3": {}, "published": "2013-10-17T19:03:34", "type": "mageia", "title": "Updated torque packages fix CVE-2013-4319\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-17T19:03:34", "id": "MGASA-2013-0308", "href": "https://advisories.mageia.org/MGASA-2013-0308.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-06-05T15:16:09", "description": "Updated torque packages fix security vulnerability: A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server (CVE-2013-4495). \n", "cvss3": {}, "published": "2013-11-18T14:41:45", "type": "mageia", "title": "Updated torque packages fix CVE-2013-4495\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-18T14:41:45", "id": "MGASA-2013-0327", "href": "https://advisories.mageia.org/MGASA-2013-0327.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2023-06-06T14:25:34", "description": "pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.", "cvss3": {}, "published": "2013-10-11T22:55:00", "type": "cve", "title": "CVE-2013-4319", "cwe": ["CWE-264"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-15T16:05:00", "cpe": ["cpe:/a:adaptivecomputing:torque_resource_manager:2.4.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.10", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.14", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.4.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.0", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.4", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.8", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.1", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.15", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.8", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.5", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.17", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.13", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.3", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.16", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.10", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.2"], "id": "CVE-2013-4319", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4319", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.14:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.7:*:*:*:*:*:*:*"]}, {"lastseen": "2023-06-06T14:26:17", "description": "The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.", "cvss3": {}, "published": "2013-11-20T14:12:00", "type": "cve", "title": "CVE-2013-4495", "cwe": ["CWE-94"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2016-12-08T03:03:00", "cpe": ["cpe:/a:adaptivecomputing:torque_resource_manager:2.4.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.10", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.14", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.4.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.0", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.4", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.8", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.1", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.15", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.8", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.5", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.17", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.13", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.3", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.16", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.10", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.2"], "id": "CVE-2013-4495", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4495", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.14:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.7:*:*:*:*:*:*:*"]}], "ubuntucve": [{"lastseen": "2023-06-06T14:39:32", "description": "pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE\nResource Manager) 2.5.x, 4.x, and earlier does not properly restrict access\nby unprivileged ports, which allows remote authenticated users to execute\narbitrary jobs by submitting a command.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722306>\n", "cvss3": {}, "published": "2013-10-11T00:00:00", "type": "ubuntucve", "title": "CVE-2013-4319", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-11T00:00:00", "id": "UB:CVE-2013-4319", "href": "https://ubuntu.com/security/CVE-2013-4319", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-06-06T14:39:00", "description": "The send_the_mail function in server/svr_mail.c in Terascale Open-Source\nResource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6\nallows remote attackers to execute arbitrary commands via shell\nmetacharacters in the email (-M switch) to qsub.", "cvss3": {}, "published": "2013-11-20T00:00:00", "type": "ubuntucve", "title": "CVE-2013-4495", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-20T00:00:00", "id": "UB:CVE-2013-4495", "href": "https://ubuntu.com/security/CVE-2013-4495", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "gentoo": [{"lastseen": "2023-06-06T15:26:55", "description": "### Background\n\nTORQUE is a resource manager and queuing system based on OpenPBS.\n\n### Description\n\nMultiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, or bypass security restrictions. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll TORQUE Resource Manager 4.x users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-cluster/torque-4.1.7\"\n \n\nAll TORQUE Resource Manager 2.x users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-cluster/torque-2.5.13\"\n \n\nNOTE: One or more of the issues described in this advisory have been fixed in previous updates. They are included in this advisory for the sake of completeness. It is likely that your system is already no longer affected by them.", "cvss3": {}, "published": "2014-12-26T00:00:00", "type": "gentoo", "title": "TORQUE Resource Manager: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193", "CVE-2011-2907", "CVE-2011-4925", "CVE-2013-4319", "CVE-2013-4495", "CVE-2014-0749"], "modified": "2014-12-26T00:00:00", "id": "GLSA-201412-47", "href": "https://security.gentoo.org/glsa/201412-47", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
[SECURITY] Fedora 19 Update: torque-3.0.4-5.fc19
