Secunia

Tomasz Grabowski has reported some vulnerabilities in Platform LSF, which can be exploited by malicious people to impersonate other users, gain escalated privileges, and potentially compromise a vulnerable system.

1) It is possible to communicate with LSF while impersonating another user due to an authentication error in the eauth component. The problem is that a UID specified in the "LSF_EAUTH_UID" environment variable may be used instead of a user's real UID when performing actions on a LSF cluster.

This reportedly makes it possible to submit and control jobs (some with administrative privileges) as another user within a LSF cluster.

2) A boundary error in the eauth component allows malicious users to gain escalated privileges or compromise a system within a LSF cluster when eauth runs in "-s" mode. This can be exploited to cause a buffer overflow by supplying an overly long input string to the "LSF_From_PC" parameter.

This allows execution of arbitrary code with administrative privileges.

Versions 4.x, 5.x, and 6.x are reportedly affected by the vulnerabilities.

Solution
The vendor has reportedly issued patches and knowledge base articles ("KB1-5T4XV" and "KB1-5RZI1").

Provided and/or discovered by
Tomasz Grabowski

Deep Links
Links available in Customer Area