PT-2014-2571 · Apache · Apache Hadoop

Publicado 2014-01-24 · Atualizado 2022-05-17 · CVE-2013-2192

Positive Technologies (AI Summary)

CVSS v2.0

3.2

Baixa

Vetor base

AV:A/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 1.x prior to 1.2.1 Apache Hadoop versions 0.23.x prior to 0.23.9 Apache Hadoop versions 2.x prior to 2.0.6-alpha

Description The issue concerns the RPC protocol implementation in Apache Hadoop when Kerberos security features are enabled. It allows man-in-the-middle attackers to disable bidirectional authentication, forcing a downgrade to simple authentication and potentially obtaining sensitive information.

Recommendations For Apache Hadoop versions 1.x prior to 1.2.1, update to version 1.2.1 or later. For Apache Hadoop versions 0.23.x prior to 0.23.9, update to version 0.23.9 or later. For Apache Hadoop versions 2.x prior to 2.0.6-alpha, update to version 2.0.6-alpha or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-2192

GHSA-PXV5-5VMP-3JJ4

RHSA-2014:0037

Produtos afetados

Apache Hadoop

Referências · 7

• http://seclists.org/fulldisclosure/2013/Aug/251 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0400.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2192 · Nota de Segurança
• https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0037.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pxv5-5vmp-3jj4 · Aviso do Fabricante
• http://secunia.com/advisories/57915 · Nota