PT-2014-2572 · Apache · Apache Hbase

Aaron T. Myers + 1 · Publicado 2014-05-29 · Atualizado 2017-03-24 · CVE-2013-2193

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:A/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HBase versions 0.92.x through 0.92.2 Apache HBase versions 0.94.x through 0.94.8

Description The issue allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors when the Kerberos features are enabled.

Recommendations For Apache HBase versions 0.92.x through 0.92.2, update to version 0.92.3 or later. For Apache HBase versions 0.94.x through 0.94.8, update to version 0.94.9 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-2193

Produtos afetados

Apache Hbase

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-2193 · Nota de Segurança
• http://seclists.org/fulldisclosure/2013/Aug/250 · Nota
• https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · Nota
• http://osvdb.org/96615 · Nota