PT-2017-8643 · Apache · Apache Hadoop

Kihwal Lee · Published 2017-08-30 · Updated 2022-05-13 · CVE-2016-5001

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.6.4 Apache Hadoop versions 2.7.x prior to 2.7.2

Description This issue allows a local user on an HDFS DataNode to potentially gain unauthorized read access to random files. The vulnerability exists in the short-circuit reads feature of HDFS, where a user may craft a block token by guessing certain fields, thus granting them access to files they should not be able to read.

Recommendations For Apache Hadoop versions prior to 2.6.4, update to version 2.6.4 or later. For Apache Hadoop versions 2.7.x prior to 2.7.2, update to version 2.7.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-5001

GHSA-8R28-R8CP-G6CP

Affected Products

Apache Hadoop

References · 8

• https://osv.dev/vulnerability/CVE-2016-5001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5001 · Security Note
• https://osv.dev/vulnerability/GHSA-8r28-r8cp-g6cp · Vendor Advisory
• http://seclists.org/oss-sec/2016/q4/698 · Note
• https://t.me/cvenotify/17044 · Telegram Post
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E · Note
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a@%3Cuser.flink.apache.org%3E · Note
• http://securityfocus.com/bid/94950 · Note