Sensitive Information Exposure in OAR Package - CVE-2016-1235
Summary
CVE-2016-1235: The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options. Affects oar versions < 2.5.7-1. Fixed in 2.5.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OAR (Open-source Application Resource) is a resource management system designed for clusters, enabling users to manage and allocate resources efficiently. It is widely used in high-performance computing environments. The package facilitates job scheduling and resource allocation, making it essential for optimizing computational tasks. However, prior to version 2.5.7, OAR contained a vulnerability that allowed remote authenticated users to access sensitive information, potentially leading to privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2016-1235 is rooted in the oarsh script of the OAR package before version 2.5.7. It allows remote authenticated users to exploit certain OpenSSH options, which could lead to unauthorized access to sensitive information. This could result in privilege escalation, where an attacker gains higher-level access than intended, potentially compromising the entire system. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.5.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade oarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the oarsh script or limit the use of OpenSSH options that may be exploited until the package can be updated. This can be done by modifying user permissions or using firewall rules to limit access.
Conclusion
CVE-2016-1235 is a significant vulnerability in the OAR package that can lead to sensitive information exposure and privilege escalation. Users are strongly advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, implementing workarounds can provide temporary relief until a proper fix is applied.
See every vulnerability recorded for oar →
FAQ
CVE-2016-1235 is a vulnerability in the OAR package that allows remote authenticated users to access sensitive information and potentially escalate privileges.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could allow unauthorized users to gain access to sensitive information and escalate their privileges, potentially compromising the entire system.
Yes, upgrading to OAR version 2.5.7-1 or later will patch this vulnerability.
If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting access to the oarsh script or limiting OpenSSH options.
Related vulnerabilities
Recent vulnerabilities recorded for oar.
