Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @


From EGIWiki
Jump to navigation Jump to search
Main page Software Security Checklist Issue Handling Advisories Notes On Risk Advisory Template More


** WHITE information - Unimited distribution                                 
** see for distribution restrictions 


Title:       EGI SVG Advisory 'High' RISK - CVE-2013-4495 Torque Vulnerability: 
arbitrary code execution via job submission [EGI-SVG-2014-6627] **UPDATE**

Date:        2014-01-24 
Updated:     2014-02-21, 2014-03-27 (made public)



A vulnerability in Torque has been made public which allows a user to execute arbitrary 
code as root.

**UPDATE** a patched version of Torque for SL5 and SL6 has been made available in the 
EGI AppDB part  of the UMD.  This resolves all known vulnerabilities and works with APEL.  

The previous advisory provided a mitigation suggestion which protected sites until a 
better solution became available. 


A vulnerability has been found which enables a user to execute arbitrary code as root.
This has been fixed by the Torque providers. [R 1] 

Information on this vulnerability has been made public at [R 2]

This has been given CVE-2013-4495 [R 3]

The versions produced by the Torque providers do not solve all known vulnerabilities, and some 
versions of Torque do not work with APEL. 

A version has been produced by the EGI SVG in the SVG area of the AppDB area of the EGI UMD which 
contains no known vulnerabilities and works with APEL. 

Risk category

This issue has been assessed as 'High' risk by the EGI SVG Risk Assessment Team

Affected software

Versions of Torque earlier than 4.2.6 are affected by this vulnerability.

The latest version (21st February 2014)  in the SVG AppDB area of the EGI UMD has no 
known vulnerabilities. 


Sites may protect themselves from this vulnerability by disabling the embedded mail 
by setting the server 

qmgr -c 'set server mail_domain = never'

Component installation information

A version of Torque is provided in the AppDB area of the UMD solves all currently known 

This is available for el5, el6 and its derivatives, and should be suitable for most sites.   

Limited support on a best efforts basis is provided by the EGI SVG, and support is not 
guaranteed in the future. 


If sites are running Torque and have not previously carried out mitigating action, 
i.e. disabled the embedded mail as described above, they should either carry out 
mitigating action, or better still update to the version in the SVG AppDB area of 

Other information

Torque Version 4.2.6 which solves this problem is available from adaptive computing a
lso has one of the 'high' risk vulnerabilities described in the advisory [SVG-2013-5999]  
resolved, but it is not clear at present whether all problems are solved. 

Some versions of Torque do not work with the EGI accounting system, APEL, but the version 
in the EGI AppDB area does.  


SVG was alerted to this problem by Leif Nixon. 

Fixed/non-vulnerable version of Torque produced and tested by Eygene Ryabinkin.

Version placed in SVG AppDB area of the EGI UMD by Mischa Salle. 


[R 1]

[R 2] Red Hat bugzilla

[R 3]


2013-11-?? Vulnerability found and fixed by adaptive computing?
2013-11-20 Vulnerability Announced in the National Vulnerability Database
2014-01-21 SVG alerted to vulnerability by Leif Nixon, as it was public. 
2014-01-22 Acknowledgement of Leif by SVG 
2014-01-23 SVG actively carrying out risk assessment, and deciding on strategy
2014-01-24 Interim advisory issued, alerting sites and suggesting mitigating action.
2014-02-20 Non vulnerable version available in the SVG AppDB area of the UMD. 
2014-02-20 Assessment by the EGI Software Vulnerability Group reported.  
2014-02-21 Updated advisory sent to sites.
2014-03-27 Public disclosure