PT-2017-8633 · Apache · Apache Ambari

Greg S. Senia · Published 2017-03-29 · Updated 2022-05-17 · CVE-2016-4976

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Ambari versions 2.x before 2.4.0

Description The issue allows local users to obtain sensitive information, specifically KDC administrator passwords, via a process listing because these passwords are included on the kadmin command line.

Recommendations For Apache Ambari versions 2.x before 2.4.0, update to version 2.4.0 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-4976

GHSA-Q3PW-6VF2-66HF

Affected Products

Apache Ambari

References · 7

• https://osv.dev/vulnerability/GHSA-q3pw-6vf2-66hf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4976 · Security Note
• https://github.com/apache/ambari · Note
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.0 · Note
• https://web.archive.org/web/20210124014838/http://securityfocus.com/bid/97229 · Note
• http://securityfocus.com/bid/97229 · Note