CVE-2014-3684

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-30 · updated 2026-06-17
Weakness: CWE-264

Description

The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary processes via a crafted executable.

Affected products

Adaptivecomputing Torque Resource Manager: 4.2.3, 4.2.3.1, 4.2.4, 4.2.4.1, 4.2.5, 4.2.6 (+5)

References

http://advisories.mageia.org/MGASA-2014-0408.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159183.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159201.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159259.html
http://openwall.com/lists/oss-security/2014/10/02/44
http://openwall.com/lists/oss-security/2014/10/02/45
http://secunia.com/advisories/61350
http://secunia.com/advisories/61960
http://www.debian.org/security/2014/dsa-3058
http://www.mandriva.com/security/advisories?name=MDVSA-2015:124
http://advisories.mageia.org/MGASA-2014-0408.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159183.html

Get alerted when CVE-2014-3684 or the next vulnerability affects your stack