CVE-2021-25312: 
NixOS vulnerability analysis and mitigation

HTCondor before version 8.9.11 contains a critical authentication vulnerability (CVE-2021-25312) discovered on January 27, 2021. The vulnerability affects the IDTOKENS authentication method in all daemons from versions 8.9.2 through 8.9.10. When a user authenticates using IDTOKENS, they can potentially impersonate other users or the 'condor' service itself on the system (Vendor Advisory).

The vulnerability exists in the IDTOKENS authentication method, which is enabled by default. Any user who can authenticate to a condor_schedd process can exploit this vulnerability. The authentication can be performed using default methods like 'FS' on Linux or NTSSPI on Windows. The vulnerability allows attackers to use command line tools supplied with HTCondor to obtain a valid IDTOKEN, which can then be used to create custom tools to connect to the condor_schedd and impersonate other users or the 'condor' service (Vendor Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability has severe consequences as it allows attackers to impersonate any other user or the 'condor' service. An attacker could submit jobs as another user, potentially running processes and accessing files belonging to that user. By impersonating the 'condor' service, the attacker could disable or reconfigure the HTCondor daemons (Vendor Advisory).

The vulnerability requires low effort to exploit and only needs login access to the system. Any user who can authenticate to a condor_schedd can potentially exploit this vulnerability. At the time of disclosure, the vulnerability was not known to be publicly exploited (Vendor Advisory).

If IDTOKENS authentication is not required, it can be disabled by specifying a list of authentication mechanisms that excludes it. For Linux systems, administrators can set 'SEC_DEFAULT_AUTHENTICATION_METHODS = FS,PASSWORD,SSL,GSI,KERBEROS,MUNGE'. For Windows systems, the configuration should be 'SEC_DEFAULT_AUTHENTICATION_METHODS = NTSSPI,PASSWORD,SSL,KERBEROS'. After making changes, a condor_reconfig is required. The permanent fix is to upgrade to HTCondor version 8.9.11 or later (Vendor Advisory).