PT-2017-19190 · Apache · Apache Impala

Publicado 2017-10-03 · Atualizado 2019-10-03 · CVE-2017-9792

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Impala (incubating) versions prior to 2.10.0

Description A malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This action bypasses the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope.

Recommendations For Apache Impala (incubating) versions prior to 2.10.0, update to version 2.10.0 or later to enforce the privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-9792

Produtos afetados

Apache Impala

Referências · 5

• http://securityfocus.com/bid/101173 · Nota
• https://osv.dev/vulnerability/CVE-2017-9792 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/IMPALA-5638 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9792 · Nota de Segurança
• https://lists.apache.org/thread.html/74a163df0cdefcd738c8d18821e69aa69eed2ba5384c0cc255d15c4b%40%3Cannounce.apache.org%3E · Nota