Security Update for slurm-llnl Package - Arbitrary File Overwrite
Summary
DLA-921-1: slurm-llnl - security update. Affects slurm-llnl versions < 2.3.4-2+deb7u1. Fixed in 2.3.4-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slurm-llnl package is a workload manager and job scheduler for high-performance computing clusters. It is designed to efficiently allocate resources and manage jobs across a cluster of nodes. The package is commonly used in scientific and research environments to distribute and manage computational tasks. However, a vulnerability has been discovered in slurm-llnl that allows arbitrary files to be overwritten on nodes running jobs, provided that the user can trigger a failure of a Prolog script.
Vulnerability Detail
The vulnerability in slurm-llnl allows an attacker to overwrite arbitrary files on nodes running jobs. This can be exploited by running a job that triggers a failure of a Prolog script. By exploiting this vulnerability, an attacker can potentially modify critical system files or gain unauthorized access to sensitive data. It is important to note that this vulnerability requires the attacker to have the ability to run a job that can trigger the Prolog script failure.
How To Fix
Minimum fixed version
2.3.4-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade slurm-llnlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade the slurm-llnl package to the fixed version.
Conclusion
The slurm-llnl package is vulnerable to an arbitrary file overwrite issue, which can be exploited by running a job that triggers a failure of a Prolog script. To mitigate this vulnerability, it is recommended to upgrade the slurm-llnl package to version 2.3.4-2+deb7u1 or later. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slurm-llnl →
FAQ
Slurm-llnl is a workload manager and job scheduler for high-performance computing clusters. It is used to efficiently allocate resources and manage jobs across a cluster of nodes.
The vulnerability allows an attacker to overwrite arbitrary files on nodes running jobs, potentially leading to unauthorized access or modification of critical system files.
The vulnerability can be exploited by running a job that triggers a failure of a Prolog script, allowing the attacker to overwrite arbitrary files.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade the slurm-llnl package to the fixed version.
To upgrade the slurm-llnl package, use the package manager of the Debian 7 Wheezy distribution and update to version 2.3.4-2+deb7u1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for slurm-llnl.
