CVE-2021-45104
📋 TL;DR
This vulnerability in HTCondor allows attackers who can intercept network traffic to interfere with user jobs and data. It affects HTCondor installations where network data can be captured, potentially impacting job execution and data integrity.
💻 Affected Systems
- HTCondor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate job execution, steal sensitive data from jobs, or cause job failures across the HTCondor cluster.
Likely Case
Attackers with network access could disrupt specific jobs or intercept job data, leading to data leakage or job failures.
If Mitigated
With proper network segmentation and encryption, impact is limited to authorized users within the protected network segment.
🎯 Exploit Status
Requires network access to capture HTCondor traffic; no authentication bypass needed once network access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.10 or 9.5.1
Vendor Advisory: https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0006/
Restart Required: Yes
Instructions:
1. Download HTCondor 9.0.10 or 9.5.1 from official sources. 2. Stop HTCondor services. 3. Install the updated version. 4. Restart HTCondor services.
🔧 Temporary Workarounds
Network Segmentation
allIsolate HTCondor traffic to trusted network segments only
Enable Encryption
linuxConfigure HTCondor to use encrypted communications between components
condor_config_val -set SEC_DEFAULT_ENCRYPTION = REQUIRED
condor_reconfig
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access HTCondor network traffic
- Monitor HTCondor network traffic for unusual patterns or unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check HTCondor version: condor_version | grep -E '9\.0\.[0-9]|9\.1\.[0-4]'Check Version:
condor_versionVerify Fix Applied:
Verify version is 9.0.10 or higher for 9.0.x branch, or 9.5.1 or higher for 9.1.x branch📡 Detection & Monitoring
Log Indicators:
- Unexpected job failures
- Unusual network connections to HTCondor ports
- Authentication errors from unknown sources
Network Indicators:
- Unusual traffic patterns on HTCondor ports (9618, 9614)
- Network sniffing tools detected on HTCondor network segments
SIEM Query:
source="htcondor.log" AND (event="job_failure" OR event="authentication_error") | stats count by src_ip🔗 References
- https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0006/
- https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0002
- https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0006/
- https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0002
