Cluster Resources Torque Resource Manager PBS_MOM Insecure Temporary File Creation Vulnerability

Bugtraq ID:	20632
Class:	Design Error
CVE:	CVE-2006-5677
Remote:	No
Local:	Yes
Published:	Oct 19 2006 12:00AM
Updated:	Nov 22 2006 10:55PM
Credit:	Luís Miguel Ferreira da Silva is credited with the discovery of this vulnerability.
Vulnerable:	Gentoo Linux Cluster Resources TORQUE Resource Manager 2.0 p8
Not Vulnerable:	Cluster Resources TORQUE Resource Manager 2.1.3 Cluster Resources TORQUE Resource Manager 2.1.2 Cluster Resources TORQUE Resource Manager 2.1.1 Cluster Resources TORQUE Resource Manager 2.1 p0

Cluster Resources Torque Resource Manager PBS_MOM Insecure Temporary File Creation Vulnerability

TORQUE Resource Manager creates temporary files in an insecure manner.

Attackers could exploit this issue to perform symlink attacks to overwrite arbitrary files using superuser privileges.

Exploiting this issue could result in the complete compromise of the affected system.

Versions prior to 2.1.0p0 are vulnerable.

Cluster Resources Torque Resource Manager PBS_MOM Insecure Temporary File Creation Vulnerability

A proof-of-concept paper is available for this issue. Please see the references for more information.

Cluster Resources Torque Resource Manager PBS_MOM Insecure Temporary File Creation Vulnerability

Solution:
This issue has been fixed as of version 2.1.0p0. Please see the references for further information.


Cluster Resources TORQUE Resource Manager 2.0 p8

• Cluster Resources TORQUE Resource Manager version 2.1.3
  http://www.clusterresources.com/downloads/torque/torque-2.1.3.tar.gz

Cluster Resources Torque Resource Manager PBS_MOM Insecure Temporary File Creation Vulnerability

References:

• TORQUE Homepage (Cluster Resources)
  
• TORQUE Spool Job Race condition (torque <= 2.0.0p8) (Luís Miguel Ferreira da Silva)