PT-2017-4253 · Apache · Apache Hadoop

Publicado 2017-04-11 · Atualizado 2022-05-14 · CVE-2016-6811

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.x through 2.7.3

Description The issue is related to privilege management errors in the Apache Hadoop platform, allowing a remote attacker to exploit the weakness and execute arbitrary commands with superuser privileges. A user who can escalate to the yarn user may possibly run arbitrary commands as the root user.

Recommendations For Apache Hadoop versions 2.x through 2.7.3, update to version 2.7.4 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

CWE-277

Identificadores relacionados

BDU:2023-05253

CVE-2016-6811

GHSA-MF7C-35MQ-75PJ

Produtos afetados

Apache Hadoop

Referências · 6

• https://lists.apache.org/thread.html/9ba3c12bbdfd5b2cae60909e48f92608e00c8d99196390b8cfeca307@%3Cgeneral.hadoop.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2016-6811 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6811 · Nota de Segurança
• https://lists.apache.org/thread.html/9ba3c12bbdfd5b2cae60909e48f92608e00c8d99196390b8cfeca307%40%3Cgeneral.hadoop.apache.org%3E · Nota
• https://bdu.fstec.ru/vul/2023-05253 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mf7c-35mq-75pj · Aviso do Fabricante