PT-2017-3336 · Apache · Apache Hadoop

Publicado 2017-06-02 · Atualizado 2022-05-17 · CVE-2017-7669

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.8.0 through 2.8.0 Apache Hadoop versions 3.0.0-alpha1 through 3.0.0-alpha2

Description The issue in Apache Hadoop is related to insufficient input validation, allowing authenticated users to run commands as root when the docker feature is enabled. This can be exploited by a remote attacker to execute commands with root privileges.

Recommendations For Apache Hadoop version 2.8.0, update to version 2.8.1 to resolve the issue. For Apache Hadoop versions 3.0.0-alpha1 and 3.0.0-alpha2, update to version 3.0.0-alpha3 to resolve the issue. As a temporary workaround, consider disabling the docker feature to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2018-00101

CVE-2017-7669

GHSA-H24P-QWF4-84Q8

Produtos afetados

Apache Hadoop

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-7669 · Aviso do Fabricante
• http://securityfocus.com/bid/98795 · Nota
• https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3E · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h24p-qwf4-84q8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7669 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00101 · Nota de Segurança