PT-2017-8643 · Apache · Apache Hadoop

Kihwal Lee · Publicado 2017-08-30 · Atualizado 2022-05-13 · CVE-2016-5001

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.6.4 Apache Hadoop versions 2.7.x prior to 2.7.2

Description This issue allows a local user on an HDFS DataNode to potentially gain unauthorized read access to random files. The vulnerability exists in the short-circuit reads feature of HDFS, where a user may craft a block token by guessing certain fields, thus granting them access to files they should not be able to read.

Recommendations For Apache Hadoop versions prior to 2.6.4, update to version 2.6.4 or later. For Apache Hadoop versions 2.7.x prior to 2.7.2, update to version 2.7.2 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-5001

GHSA-8R28-R8CP-G6CP

Produtos afetados

Apache Hadoop

Referências · 8

• http://seclists.org/oss-sec/2016/q4/698 · Nota
• https://t.me/cvenotify/17044 · Publicação no Telegram
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2016-5001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5001 · Nota de Segurança
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a@%3Cuser.flink.apache.org%3E · Nota
• http://securityfocus.com/bid/94950 · Nota
• https://osv.dev/vulnerability/GHSA-8r28-r8cp-g6cp · Aviso do Fabricante