HTCondor (condor_startd, condor_schedd, condor_shadow): One CVE covering four separate authentication failures the

Impact

One CVE covering four separate authentication failures the HTCondor team disclosed together. The slot claim secret is written in the clear to STARTD_HISTORY and is also sent unencrypted on the wire when daemon-to-daemon encryption is off - either one lets an attacker seize another user's slot and run their own code as that user. Separately, a user with only READ authorization can perform WRITE operations on the job queue, and if CLAIMTOBE is in the READ method list (the default) they can submit and run jobs as any other user. On mixed Windows/Linux pools the shadow will also hand a user's stored Windows password to anyone authenticating as the condor service.

Who can reach it

Depends on the sub-issue: reading a world-readable file from inside your own job on an execute node; passively capturing schedd-to-startd traffic; or simply authenticating to the schedd with any READ-list method. The CLAIMTOBE variant needs nothing but network reach to a default-configured pool.

What to do

Upgrade to HTCondor 8.8.8 or 8.9.6 and restart all daemons. Independently of the patch, turn on daemon-to-daemon encryption, remove CLAIMTOBE from SEC_READ_AUTHENTICATION_METHODS, and disable match-password authentication in favour of a real method (SSL, Kerberos, TOKEN). Rotate any Windows credentials stored with condor_store_cred.

References

Related entries

• Lustre ptlrpc module (server-side client packet validation): A Lustre client can send a crafted RPC that overflows aCVE-2019-20427 · Lustre ptlrpc module (server-side client packet validation)Critical
• NetApp ONTAP Select Deploy administration utility (HTTP service): An unauthenticated attacker performs administrativeCVE-2019-5504 · NetApp ONTAP Select Deploy administration utility (HTTP service)Critical
• NetApp ONTAP Select Deploy administration utility (credential transport): Deploy sends its credentials in plaintext, soCVE-2019-5505 · NetApp ONTAP Select Deploy administration utility (credential transport)Critical
• NetApp ONTAP Select Deploy administration utility (code injection): An unauthenticated remote attacker injects code andCVE-2019-5509 · NetApp ONTAP Select Deploy administration utility (code injection)Critical
• Slurm (32-bit RPC handling): Memory corruption on 32-bit Slurm builds reachable from a crafted RPC, up to control ofCVE-2019-6438 · Slurm (32-bit RPC handling)Critical
• Optergy Proton / Enterprise building management platform: A backdoor console giving remote root code executionCVE-2019-7276 · Optergy Proton / Enterprise building management platformCritical