The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary processes via a crafted executable.

Bugfix - #1215207 create/install service files for these

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated torque packages fix security vulnerabilities :

Chad Vizino reported that within a TORQUE Resource Manager job a non-root user could use a vulnerability in the tm_adopt() library call to kill processes he/she doesn't own including root-owned ones on any node in a job (CVE-2014-3684).

This update implements the upstream fixes.

Chad Vizino reported a vulnerability in torque, a PBS-derived batch processing queueing system. A non-root user could exploit the flaw in the tm_adopt() library call to kill any process, including root-owned ones on any node in a job.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chad Vizino reported a vulnerability in torque, a PBS-derived batch processing queueing system. A non-root user could exploit the flaw in the tm_adopt() library call to kill any process, including root-owned ones on any node in a job.

ID	Name	Product	Family	Severity
83927	Fedora 20 : torque-4.2.10-3.fc20 (2015-8577)	Nessus	Fedora Local Security Checks	medium
83926	Fedora 21 : torque-4.2.10-3.fc21 (2015-8571)	Nessus	Fedora Local Security Checks	medium
83925	Fedora 22 : torque-4.2.10-3.fc22 (2015-8544)	Nessus	Fedora Local Security Checks	medium
82377	Mandriva Linux Security Advisory : torque (MDVSA-2015:124)	Nessus	Mandriva Local Security Checks	medium
82223	Debian DLA-78-1 : torque security update	Nessus	Debian Local Security Checks	medium
78695	Debian DSA-3058-1 : torque - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-3684

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium