PT-2017-16637 · Apache · Apache Impala

Published 2017-07-10 · Updated 2017-07-17 · CVE-2017-5640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Impala (incubating) versions 2.7.0 through 2.8.0

Description A malicious process impersonating an Impala daemon could cause Impala daemons to skip authentication checks when Kerberos is enabled but TLS is not. This occurs when the malicious server responds with 'COMPLETE' before the SASL handshake has completed, leading the client to consider the handshake as completed without any exchange of credentials.

Recommendations For Apache Impala (incubating) versions 2.7.0 through 2.8.0, consider disabling Kerberos authentication until a patch is available, or enable TLS to mitigate the risk of exploitation. Restrict access to Impala daemons to minimize the risk of a malicious process impersonating a legitimate daemon.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-5640

Affected Products

Apache Impala

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5640 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5640 · Vendor Advisory
• https://lists.apache.org/thread.html/c02e83aa46c90b7cbc87dd649cf8f9b73e11053eddea9144a397da53%40%3Cdev.impala.apache.org%3E · Note
• http://securityfocus.com/bid/99508 · Note