PT-2017-4253 · Apache · Apache Hadoop

Published 2017-04-11 · Updated 2022-05-14 · CVE-2016-6811

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.x through 2.7.3

Description The issue is related to privilege management errors in the Apache Hadoop platform, allowing a remote attacker to exploit the weakness and execute arbitrary commands with superuser privileges. A user who can escalate to the yarn user may possibly run arbitrary commands as the root user.

Recommendations For Apache Hadoop versions 2.x through 2.7.3, update to version 2.7.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

CWE-277

Related Identifiers

BDU:2023-05253

CVE-2016-6811

GHSA-MF7C-35MQ-75PJ

Affected Products

Apache Hadoop

References · 6

• https://osv.dev/vulnerability/CVE-2016-6811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6811 · Security Note
• https://bdu.fstec.ru/vul/2023-05253 · Security Note
• https://osv.dev/vulnerability/GHSA-mf7c-35mq-75pj · Vendor Advisory
• https://lists.apache.org/thread.html/9ba3c12bbdfd5b2cae60909e48f92608e00c8d99196390b8cfeca307@%3Cgeneral.hadoop.apache.org%3E · Note
• https://lists.apache.org/thread.html/9ba3c12bbdfd5b2cae60909e48f92608e00c8d99196390b8cfeca307%40%3Cgeneral.hadoop.apache.org%3E · Note