CVE-2011-2907

Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBS_O_HOST variable to the qsub program.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name	Vendor	Start Version	End Version
Torque_resource_manager	Clusterresources	*	3.0.1 (including)
Torque_resource_manager	Clusterresources	2.1.0 (including)	2.1.0 (including)
Torque_resource_manager	Clusterresources	2.1.0p11 (including)	2.1.0p11 (including)
Torque_resource_manager	Clusterresources	2.1.1 (including)	2.1.1 (including)
Torque_resource_manager	Clusterresources	2.1.2 (including)	2.1.2 (including)
Torque_resource_manager	Clusterresources	2.1.3 (including)	2.1.3 (including)
Torque_resource_manager	Clusterresources	2.1.6 (including)	2.1.6 (including)
Torque_resource_manager	Clusterresources	2.1.7 (including)	2.1.7 (including)
Torque_resource_manager	Clusterresources	2.1.8 (including)	2.1.8 (including)
Torque_resource_manager	Clusterresources	2.1.9 (including)	2.1.9 (including)
Torque_resource_manager	Clusterresources	2.1.10 (including)	2.1.10 (including)
Torque_resource_manager	Clusterresources	2.1.11 (including)	2.1.11 (including)
Torque_resource_manager	Clusterresources	2.2.1 (including)	2.2.1 (including)
Torque_resource_manager	Clusterresources	2.3.0 (including)	2.3.0 (including)
Torque_resource_manager	Clusterresources	2.3.1 (including)	2.3.1 (including)
Torque_resource_manager	Clusterresources	2.3.2 (including)	2.3.2 (including)
Torque_resource_manager	Clusterresources	2.3.3 (including)	2.3.3 (including)
Torque_resource_manager	Clusterresources	2.3.4 (including)	2.3.4 (including)
Torque_resource_manager	Clusterresources	2.3.5 (including)	2.3.5 (including)
Torque_resource_manager	Clusterresources	2.3.6 (including)	2.3.6 (including)
Torque_resource_manager	Clusterresources	2.3.7 (including)	2.3.7 (including)
Torque_resource_manager	Clusterresources	2.3.8 (including)	2.3.8 (including)
Torque_resource_manager	Clusterresources	2.3.9 (including)	2.3.9 (including)
Torque_resource_manager	Clusterresources	2.3.10 (including)	2.3.10 (including)
Torque_resource_manager	Clusterresources	2.3.11 (including)	2.3.11 (including)
Torque_resource_manager	Clusterresources	2.3.12 (including)	2.3.12 (including)
Torque_resource_manager	Clusterresources	2.3.13 (including)	2.3.13 (including)
Torque_resource_manager	Clusterresources	2.4.2 (including)	2.4.2 (including)
Torque_resource_manager	Clusterresources	2.4.3 (including)	2.4.3 (including)
Torque_resource_manager	Clusterresources	2.4.4 (including)	2.4.4 (including)
Torque_resource_manager	Clusterresources	2.4.5 (including)	2.4.5 (including)
Torque_resource_manager	Clusterresources	2.4.6 (including)	2.4.6 (including)
Torque_resource_manager	Clusterresources	2.4.7 (including)	2.4.7 (including)
Torque_resource_manager	Clusterresources	2.4.8 (including)	2.4.8 (including)
Torque_resource_manager	Clusterresources	2.4.9 (including)	2.4.9 (including)
Torque_resource_manager	Clusterresources	2.4.10 (including)	2.4.10 (including)
Torque_resource_manager	Clusterresources	2.4.11 (including)	2.4.11 (including)
Torque_resource_manager	Clusterresources	2.4.12 (including)	2.4.12 (including)
Torque_resource_manager	Clusterresources	2.4.13 (including)	2.4.13 (including)
Torque_resource_manager	Clusterresources	2.5.0 (including)	2.5.0 (including)
Torque_resource_manager	Clusterresources	2.5.1 (including)	2.5.1 (including)
Torque_resource_manager	Clusterresources	2.5.2 (including)	2.5.2 (including)
Torque_resource_manager	Clusterresources	2.5.3 (including)	2.5.3 (including)
Torque_resource_manager	Clusterresources	2.5.4 (including)	2.5.4 (including)
Torque_resource_manager	Clusterresources	2.5.5 (including)	2.5.5 (including)
Torque_resource_manager	Clusterresources	3.0.0 (including)	3.0.0 (including)
Torque	Ubuntu	esm-apps/xenial	*
Torque	Ubuntu	esm-infra-legacy/trusty	*
Torque	Ubuntu	hardy	*
Torque	Ubuntu	lucid	*
Torque	Ubuntu	maverick	*
Torque	Ubuntu	natty	*
Torque	Ubuntu	oneiric	*
Torque	Ubuntu	precise	*
Torque	Ubuntu	quantal	*
Torque	Ubuntu	raring	*
Torque	Ubuntu	saucy	*
Torque	Ubuntu	trusty	*
Torque	Ubuntu	trusty/esm	*
Torque	Ubuntu	utopic	*
Torque	Ubuntu	vivid	*
Torque	Ubuntu	wily	*
Torque	Ubuntu	xenial	*
Torque	Ubuntu	yakkety	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-2907
CWE	https://cwe.mitre.org/data/definitions/287.html

Improper Authentication

Weakness

Affected Software

Potential Mitigations

References

CVE-2011-2907

Improper Authentication

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References