PT-2012-4671 · Apache · Apache Hadoop

Published 2012-07-12 · Updated 2022-05-17 · CVE-2012-3376

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Hadoop version 2.0.0 alpha

Description The issue concerns a problem where DataNodes in Apache Hadoop do not properly check BlockTokens of clients when Kerberos is enabled and a specific condition involving BlockPool checkout is met. This could potentially allow remote clients to read arbitrary blocks, write to blocks they only have read access to, and possibly have other unspecified impacts.

Recommendations For Apache Hadoop version 2.0.0 alpha, consider disabling Kerberos or restricting access to the DataNode until a proper fix is available. As a temporary workaround, restrict the checkout of the same BlockPool twice from a NodeName to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-3376

GHSA-QMH2-H7R6-GM6Q

Affected Products

Apache Hadoop

References · 7

• https://osv.dev/vulnerability/GHSA-qmh2-h7r6-gm6q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3376 · Security Note
• https://github.com/apache/hadoop · Note
• http://securityfocus.com/bid/54358 · Note
• https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · Note
• https://seclists.org/fulldisclosure/2012/Jul/78 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-07/0049.html · Note