PT-2017-19190 · Apache · Apache Impala

Published 2017-10-03 · Updated 2019-10-03 · CVE-2017-9792

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Impala (incubating) versions prior to 2.10.0

Description A malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This action bypasses the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope.

Recommendations For Apache Impala (incubating) versions prior to 2.10.0, update to version 2.10.0 or later to enforce the privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-9792

Affected Products

Apache Impala

References · 5

• https://osv.dev/vulnerability/CVE-2017-9792 · Vendor Advisory
• https://issues.apache.org/jira/browse/IMPALA-5638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9792 · Security Note
• http://securityfocus.com/bid/101173 · Note
• https://lists.apache.org/thread.html/74a163df0cdefcd738c8d18821e69aa69eed2ba5384c0cc255d15c4b%40%3Cannounce.apache.org%3E · Note