CVE-2009-2084
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
26.7%
Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| llnl | slurm | * | cpe:2.3:a:llnl:slurm:*:*:*:*:*:*:*:* |
| llnl | slurm | 1.2 | cpe:2.3:a:llnl:slurm:1.2:*:*:*:*:*:*:* |
| llnl | slurm | 1.3 | cpe:2.3:a:llnl:slurm:1.3:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.1 | cpe:2.3:a:llnl:slurm:1.3.1:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.2 | cpe:2.3:a:llnl:slurm:1.3.2:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.3 | cpe:2.3:a:llnl:slurm:1.3.3:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.4 | cpe:2.3:a:llnl:slurm:1.3.4:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.5 | cpe:2.3:a:llnl:slurm:1.3.5:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.6 | cpe:2.3:a:llnl:slurm:1.3.6:*:*:*:*:*:*:* |
| llnl | slurm | 1.3.7 | cpe:2.3:a:llnl:slurm:1.3.7:*:*:*:*:*:*:* |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=524980
secunia.com/advisories/34831
sourceforge.net/project/shownotes.php?release_id=676055&group_id=157944
www.debian.org/security/2009/dsa-1776
www.securityfocus.com/bid/34638
www.vupen.com/english/advisories/2009/1128
exchange.xforce.ibmcloud.com/vulnerabilities/50126
exchange.xforce.ibmcloud.com/vulnerabilities/50127
Related
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
26.7%