PT-2017-9022 · Apache · Ambari Agent

Publicado 2017-03-28 · Atualizado 2022-05-17 · CVE-2016-6807

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ambari Agent versions 2.4.x through 2.4.1 Ambari Agent versions prior to 2.4.2

Description The issue allows custom commands to be executed on Ambari Agent hosts without proper authorization. This can lead to unauthorized access to certain operations that may impact the underlying system. These operations are invoked by the Ambari Agent process, running as the user who executes the Ambari Agent process.

Recommendations For Ambari Agent versions 2.4.x through 2.4.1, update to version 2.4.2 or later to resolve the issue. For Ambari Agent versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-6807

GHSA-J76Q-99X2-V7VQ

Produtos afetados

Ambari Agent

Referências · 7

• https://github.com/apache/ambari · Nota
• https://osv.dev/vulnerability/GHSA-j76q-99x2-v7vq · Aviso do Fabricante
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6807 · Nota de Segurança
• https://web.archive.org/web/20200227181557/http://securityfocus.com/bid/97184 · Nota
• https://osv.dev/vulnerability/CVE-2016-6807 · Aviso do Fabricante
• http://securityfocus.com/bid/97184 · Nota