Vulnerability Details : CVE-2012-3416
Condor before 7.8.2 allows remote attackers to bypass host-based authentication and execute actions such as ALLOW_ADMINISTRATOR or ALLOW_WRITE by connecting from a system with a spoofed reverse DNS hostname.
Vulnerability category: BypassGain privilege
Products affected by CVE-2012-3416
- cpe:2.3:a:condor_project:condor:*:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.9:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:6.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.01:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.03:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.00:*:*:*:*:*:*:*
- cpe:2.3:a:condor_project:condor:7.02:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-3416
1.78%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-3416
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2012-3416
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-3416
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/77748
Condor reverse DNS security bypass CVE-2012-3416 Vulnerability Report
-
http://www.securityfocus.com/bid/55032
Condor CVE-2012-3416 Security Bypass Vulnerability
-
http://rhn.redhat.com/errata/RHSA-2012-1168.html
RHSA-2012:1168 - Security Advisory - Red Hat Customer Portal
-
http://www.securitytracker.com/id?1027395
Condor Host-based Access Controls Can Be Bypased By Remote Users - SecurityTracker
-
http://rhn.redhat.com/errata/RHSA-2012-1169.html
RHSA-2012:1169 - Security Advisory - Red Hat Customer Portal
-
http://research.cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2012-0002.html
CONDOR-2012-0002
Jump to