Skip to content
Fencer Vulns
medium 6.5

CVE-2009-4133 json

Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated user…

published 2009-12-23 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-4103

cvss
6.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job attribute.

Patch / fix

  • condor enterprise mrg 1 7.4.1-0.7.1.el5
  • condor-kbdd enterprise mrg 1 7.4.1-0.7.1.el5
  • condor-vm-gahp enterprise mrg 1 7.4.1-0.7.1.el5
  • condor-qmf-plugins enterprise mrg 1 7.4.1-0.7.1.el5
  • condor enterprise mrg 1.0 7.4.1-0.7.1.el4
  • condor-kbdd enterprise mrg 1.0 7.4.1-0.7.1.el4
  • condor-qmf-plugins enterprise mrg 1.0 7.4.1-0.7.1.el4

red hat advisories RHSA-2009:1689RHSA-2009:1688

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-4133 updated cvss 5.8

Condor: queue super user cannot drop privs

  • Red Hat MRG Grid Execute Node for RHEL 5 Server condor 7.4.1-0.7.1.el5, condor-kbdd 7.4.1-0.7.1.el5, condor-vm-gahp 7.4.1-0.7.1.el5, condor-qmf-plugins 7.4.1-0.7.1.el5 Red Hat MRG Grid for RHEL 5 Server condor 7.4.1-0.7.1.el5, condor-kbdd 7.4.1-0.7.1.el5, condor-vm-gahp 7.4.1-0.7.1.el5, condor-qmf-plugins 7.4.1-0.7.1.el5
    fixed: vendor fix RHSA-2009:1689
  • Red Hat MRG Grid Execute Node for RHEL-4 AS condor 7.4.1-0.7.1.el4, condor-kbdd 7.4.1-0.7.1.el4, condor-qmf-plugins 7.4.1-0.7.1.el4 Red Hat MRG Grid Execute Node for RHEL-4 ES condor 7.4.1-0.7.1.el4, condor-kbdd 7.4.1-0.7.1.el4, condor-qmf-plugins 7.4.1-0.7.1.el4 Red Hat MRG Grid for RHEL-4 AS condor 7.4.1-0.7.1.el4, condor-kbdd 7.4.1-0.7.1.el4, condor-qmf-plugins 7.4.1-0.7.1.el4 Red Hat MRG Grid for RHEL-4 ES condor 7.4.1-0.7.1.el4, condor-kbdd 7.4.1-0.7.1.el4, condor-qmf-plugins 7.4.1-0.7.1.el4
    fixed: vendor fix RHSA-2009:1688

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.08% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.