PT-2012-4671 · Apache · Apache Hadoop

Publicado 2012-07-12 · Atualizado 2022-05-17 · CVE-2012-3376

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Hadoop version 2.0.0 alpha

Description The issue concerns a problem where DataNodes in Apache Hadoop do not properly check BlockTokens of clients when Kerberos is enabled and a specific condition involving BlockPool checkout is met. This could potentially allow remote clients to read arbitrary blocks, write to blocks they only have read access to, and possibly have other unspecified impacts.

Recommendations For Apache Hadoop version 2.0.0 alpha, consider disabling Kerberos or restricting access to the DataNode until a proper fix is available. As a temporary workaround, restrict the checkout of the same BlockPool twice from a NodeName to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-3376

GHSA-QMH2-H7R6-GM6Q

Produtos afetados

Apache Hadoop

Referências · 7

• https://github.com/apache/hadoop · Nota
• http://securityfocus.com/bid/54358 · Nota
• https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · Nota
• https://seclists.org/fulldisclosure/2012/Jul/78 · Nota
• https://osv.dev/vulnerability/GHSA-qmh2-h7r6-gm6q · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3376 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2012-07/0049.html · Nota