PT-2017-3336 · Apache · Apache Hadoop

Published 2017-06-02 · Updated 2022-05-17 · CVE-2017-7669

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.8.0 through 2.8.0 Apache Hadoop versions 3.0.0-alpha1 through 3.0.0-alpha2

Description The issue in Apache Hadoop is related to insufficient input validation, allowing authenticated users to run commands as root when the docker feature is enabled. This can be exploited by a remote attacker to execute commands with root privileges.

Recommendations For Apache Hadoop version 2.8.0, update to version 2.8.1 to resolve the issue. For Apache Hadoop versions 3.0.0-alpha1 and 3.0.0-alpha2, update to version 3.0.0-alpha3 to resolve the issue. As a temporary workaround, consider disabling the docker feature to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-00101

CVE-2017-7669

GHSA-H24P-QWF4-84Q8

Affected Products

Apache Hadoop

References · 6

• https://osv.dev/vulnerability/CVE-2017-7669 · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h24p-qwf4-84q8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7669 · Security Note
• https://bdu.fstec.ru/vul/2018-00101 · Security Note
• http://securityfocus.com/bid/98795 · Note