PT-2012-3349 · Apache+2 · Apache Hadoop+3

Aaron T. Myers · Publicado 2012-04-12 · Atualizado 2022-05-17 · CVE-2012-1574

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 0.20.203.0 through 0.20.205.0 Apache Hadoop versions 0.23.x before 0.23.2 Apache Hadoop versions 1.0.x before 1.0.2 Cloudera CDH versions CDH3u0 through CDH3u2 Cloudera hadoop-0.20-sbin versions before 0.20.2+923.197

Description The issue allows remote authenticated users to impersonate arbitrary cluster user accounts. This is related to the Kerberos/MapReduce security functionality in Apache Hadoop.

Recommendations For Apache Hadoop versions 0.20.203.0 through 0.20.205.0, update to a version outside of this range to resolve the issue. For Apache Hadoop versions 0.23.x before 0.23.2, update to version 0.23.2 or later. For Apache Hadoop versions 1.0.x before 1.0.2, update to version 1.0.2 or later. For Cloudera CDH versions CDH3u0 through CDH3u2, update to a version outside of this range. For Cloudera hadoop-0.20-sbin versions before 0.20.2+923.197, update to version 0.20.2+923.197 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-310

Identificadores relacionados

CVE-2012-1574

GHSA-C6F9-4PMV-M7M6

Produtos afetados

Apache Hadoop

Cloudera Cdh

Cloudera Hadoop-0.20-Sbin

Kerberos

Referências · 15

• https://github.com/apache/hadoop · Nota
• https://seclists.org/fulldisclosure/2012/Apr/70 · Nota
• https://web.archive.org/web/20200229125105/http://securityfocus.com/bid/52939 · Nota
• https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · Nota
• http://secunia.com/advisories/48776 · Nota
• https://web.archive.org/web/20120720041621/https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin#ClouderaSecurityBulletin-MapReducewithSecurity · Nota
• https://web.archive.org/web/20161215212154/https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_2 · Nota
• https://osv.dev/vulnerability/GHSA-c6f9-4pmv-m7m6 · Aviso do Fabricante
• https://web.archive.org/web/20151001135054/http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html · Nota
• https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin · Aviso do Fabricante
• http://securityfocus.com/bid/52939 · Nota
• http://seclists.org/fulldisclosure/2012/Apr/70 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html · Nota
• http://secunia.com/advisories/48775 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1574 · Nota de Segurança