PT-2017-16637 · Apache · Apache Impala

Publicado 2017-07-10 · Atualizado 2017-07-17 · CVE-2017-5640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Impala (incubating) versions 2.7.0 through 2.8.0

Description A malicious process impersonating an Impala daemon could cause Impala daemons to skip authentication checks when Kerberos is enabled but TLS is not. This occurs when the malicious server responds with 'COMPLETE' before the SASL handshake has completed, leading the client to consider the handshake as completed without any exchange of credentials.

Recommendations For Apache Impala (incubating) versions 2.7.0 through 2.8.0, consider disabling Kerberos authentication until a patch is available, or enable TLS to mitigate the risk of exploitation. Restrict access to Impala daemons to minimize the risk of a malicious process impersonating a legitimate daemon.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-5640

Produtos afetados

Apache Impala

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5640 · Nota de Segurança
• https://lists.apache.org/thread.html/c02e83aa46c90b7cbc87dd649cf8f9b73e11053eddea9144a397da53%40%3Cdev.impala.apache.org%3E · Nota
• http://securityfocus.com/bid/99508 · Nota
• https://osv.dev/vulnerability/CVE-2017-5640 · Aviso do Fabricante