PT-2016-6406 · Apache · Apache Hadoop

Freddie Rice · Publicado 2016-11-29 · Atualizado 2022-05-17 · CVE-2016-5393

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.6.x through 2.6.4 Apache Hadoop versions 2.7.x through 2.7.2

Description A remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.

Recommendations For Apache Hadoop versions 2.6.x through 2.6.4, update to version 2.6.5 or later. For Apache Hadoop versions 2.7.x through 2.7.2, update to version 2.7.3 or later.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-5393

GHSA-7Q56-MP4C-GGGG

Produtos afetados

Apache Hadoop

Referências · 5

• http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7q56-mp4c-gggg · Aviso do Fabricante
• http://securityfocus.com/bid/94574 · Nota
• https://osv.dev/vulnerability/CVE-2016-5393 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5393 · Nota de Segurança