This message is in MIME format.

--=_3lz7fioqk4n4
Content-Type: multipart/mixed;
boundary="=_39sku5ek0jgg"
Content-Transfer-Encoding: 7bit

This message is in MIME format.

--=_39sku5ek0jgg
Content-Type: text/plain;
charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hello all,

Back in March i audited a software called TORQUE Resource Manager and found=
a
critical race condition vulnerability which could be used by malicious user=
s to
escalate their privileges.

"TORQUE is an open source resource manager providing control over batch job=
s and
distributed compute nodes. It is a community effort based on the original *=
PBS
project and, with more than 1,200 patches, has incorporated significant
advances in the areas of scalability, fault tolerance, and feature extensio=
ns
contributed by NCSA, OSC, USC , the U.S. Dept of Energy, Sandia, PNNL, U of
Buffalo, TeraGrid, and many other leading edge HPC organizations. This vers=
ion
may be freely modified and redistributed subject to the constraints of the
included license."

This paper was submitted to "Cluster Resources INC", a great grid software
company which kindly supports the TORQUE Resource Manager (Open Source)
software. They where very helpfull and profissional. A big hug to their GRE=
AT
team ;o)!!!

Iam now sharing the paper with the community:
http://csirt.fe.up.pt/docs/TORQUE-audit.pdf

PS: sorry for the PDF but the report is 13 pages long...

Best regards,
+----------------------------------------
| Lu=EDs Miguel Ferreira da Silva
| Network Administrator @ISPGaya
| Instituto Superior Polit=E9cnico Gaya
| Rua Ant=F3nio Rodrigues da Rocha, 291/341
| Sto. Ov=EDdio =95 4400-025 V. N. de Gaia
| Tel: +351 223745730/3/5
| GSM: +351 912671471
+----------------------------------------

----------------------------------------------------------------
Este email foi enviado via o webmail do ISPGaya
Instituto Superior Polit=E9cnico Gaya

--=_39sku5ek0jgg
Content-Type: application/pgp-keys
Content-Description: PGP Public Key
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.2 (GNU/Linux)

mQGiBEIbV7ARBACvJuXZEr4R4lN5xBW25YF1+ANIOg073Axak+ 3cYKSAvKeB3R7V
DB6CBHyGFdkz12UkOnsscFNl/Xhq88zN3HY+nauXOE+FhPR8U6mCfjcYzKZI6Ds7
IY0dSKss+y+lF2cF+X7Pk3/ZctVuf6U+9XkE8WgH81uHyABMJk2g6l9ukwCgpQ8K
aT1z8ss6/6crViYhARYJ95UD/RvIb3cvGv1CKQLifOzuVYgIW3cJ8IKXAaj0jej1
IwgfBWQylqER1bpp6tkXKKe7a8uSXc6FnsrjeIVZ7CE+jzjjk2 6JOyOBeMs/PTke
FE8lUE762Bpq2W/COOvd0hhMbSezPso62hY0F9IyTzfQEG2qp+AwybVU/3JVeD2b
0BWIA/0UnP14KZk1CUu1WQAK6oXQXu6YA/2KHSx7/oKinoe3IlxvnMmhmvKys+9Q
rCHhKdrs+oOL5DYMDmp8U+BJqsQJTCXSy/CGoqkir9wqC4F1mJ+26GI7v4qh7kcP
KDr/T6QiIke10zj/QrfwouNVfEGiKN853lZ0tT6EvgzoEjelKrQiTHXtcyBNaWd1
ZWwgU2lsdmEgPGxtc0Bpc3BnYXlhLnB0PohbBBMRAgAbBQJCG1 ewBgsJCAcDAgMV
AgMDFgIBAh4BAheAAAoJENXZ+CTczFd8zz0An3U23TsDq1WxOd r9Dg2xNN/Clx+o
AJ4+aDugmROM19RAwZmBu8F3Fy08OrkCDQRCG1e3EAgAjpHHgR g+5qiC6e9eAktV
u7pRfFZhwJyqMDKigkJAIN5iDmB49CfFEJVqlAUeHduNgy6kga I2BlDXxDs0tnG7
CWjjYc+/mwmO3aAMDWp0ca5PUEnQfKZunfekPLLHc26/Lo9RfMfCcodHpVfVuWMt
Bie4GCwiN/Aq4/fiQJ7my1uF1PEZllxi8FpH5+6OidlSY0Vg2T7KAkqmMgNrF2o0
Av5VL23QB+70Ff91FnlcgJQXNPhhG4fGLUiRgBiKjhARTzf5L1 GeLtyh/sfw73nm
iKXpbHUkGhX9UhbApzREGmpfh+MZBW8W6YFqys2zoo5ejePGye IubiHw3sgAiAPd
LwADBQf/RnDjS6oTX8seTr82XgPK5K9ipWtsqi/ysVSPanoDL3c1TbR7KKPLY2fj
lbuOJ6k+WWibD4B5PmMLM00Kpo9xFYcAJTGeIDCykXap7MPDpQ PflIxMpYbZXZ3G
GmdBBerihPz8f4iYqWcl/YXsxs8Z5GMxYhOMIU6P/9dGhEBUJb98lPAeJPrnlWby
5P4VrkSC/4PpK93KEjvSSdYxTQOmaJpmMkwNcjDTT+eNftJ/d8JNXHmGw5p1WHBv
2xNKWSQtyrT3GTXLM9AmbhbZtIUegguiaasgxVW+WZsBS0vDU8 +GI0Wk96ih10q2
C7DRrmQCjSTPqZhv+qL8EQeUMqoYBIhGBBgRAgAGBQJCG1e3AA oJENXZ+CTczFd8
ySoAn2g7VU0x03UveIfGP6P340EMmoI0AJ9w4I62OY41Y5rHwo DZOgifGniEyw==
=DqCm
-----END PGP PUBLIC KEY BLOCK-----

--=_39sku5ek0jgg--

--=_3lz7fioqk4n4
Content-Type: application/pgp-keys
Content-Description: PGP Public Key
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.2 (GNU/Linux)

mQGiBEIbV7ARBACvJuXZEr4R4lN5xBW25YF1+ANIOg073Axak+ 3cYKSAvKeB3R7V
DB6CBHyGFdkz12UkOnsscFNl/Xhq88zN3HY+nauXOE+FhPR8U6mCfjcYzKZI6Ds7
IY0dSKss+y+lF2cF+X7Pk3/ZctVuf6U+9XkE8WgH81uHyABMJk2g6l9ukwCgpQ8K
aT1z8ss6/6crViYhARYJ95UD/RvIb3cvGv1CKQLifOzuVYgIW3cJ8IKXAaj0jej1
IwgfBWQylqER1bpp6tkXKKe7a8uSXc6FnsrjeIVZ7CE+jzjjk2 6JOyOBeMs/PTke
FE8lUE762Bpq2W/COOvd0hhMbSezPso62hY0F9IyTzfQEG2qp+AwybVU/3JVeD2b
0BWIA/0UnP14KZk1CUu1WQAK6oXQXu6YA/2KHSx7/oKinoe3IlxvnMmhmvKys+9Q
rCHhKdrs+oOL5DYMDmp8U+BJqsQJTCXSy/CGoqkir9wqC4F1mJ+26GI7v4qh7kcP
KDr/T6QiIke10zj/QrfwouNVfEGiKN853lZ0tT6EvgzoEjelKrQiTHXtcyBNaWd1
ZWwgU2lsdmEgPGxtc0Bpc3BnYXlhLnB0PohbBBMRAgAbBQJCG1 ewBgsJCAcDAgMV
AgMDFgIBAh4BAheAAAoJENXZ+CTczFd8zz0An3U23TsDq1WxOd r9Dg2xNN/Clx+o
AJ4+aDugmROM19RAwZmBu8F3Fy08OrkCDQRCG1e3EAgAjpHHgR g+5qiC6e9eAktV
u7pRfFZhwJyqMDKigkJAIN5iDmB49CfFEJVqlAUeHduNgy6kga I2BlDXxDs0tnG7
CWjjYc+/mwmO3aAMDWp0ca5PUEnQfKZunfekPLLHc26/Lo9RfMfCcodHpVfVuWMt
Bie4GCwiN/Aq4/fiQJ7my1uF1PEZllxi8FpH5+6OidlSY0Vg2T7KAkqmMgNrF2o0
Av5VL23QB+70Ff91FnlcgJQXNPhhG4fGLUiRgBiKjhARTzf5L1 GeLtyh/sfw73nm
iKXpbHUkGhX9UhbApzREGmpfh+MZBW8W6YFqys2zoo5ejePGye IubiHw3sgAiAPd
LwADBQf/RnDjS6oTX8seTr82XgPK5K9ipWtsqi/ysVSPanoDL3c1TbR7KKPLY2fj
lbuOJ6k+WWibD4B5PmMLM00Kpo9xFYcAJTGeIDCykXap7MPDpQ PflIxMpYbZXZ3G
GmdBBerihPz8f4iYqWcl/YXsxs8Z5GMxYhOMIU6P/9dGhEBUJb98lPAeJPrnlWby
5P4VrkSC/4PpK93KEjvSSdYxTQOmaJpmMkwNcjDTT+eNftJ/d8JNXHmGw5p1WHBv
2xNKWSQtyrT3GTXLM9AmbhbZtIUegguiaasgxVW+WZsBS0vDU8 +GI0Wk96ih10q2
C7DRrmQCjSTPqZhv+qL8EQeUMqoYBIhGBBgRAgAGBQJCG1e3AA oJENXZ+CTczFd8
ySoAn2g7VU0x03UveIfGP6P340EMmoI0AJ9w4I62OY41Y5rHwo DZOgifGniEyw==
=DqCm
-----END PGP PUBLIC KEY BLOCK-----

--=_3lz7fioqk4n4--