PT-2017-9022 · Apache · Ambari Agent

Published 2017-03-28 · Updated 2022-05-17 · CVE-2016-6807

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ambari Agent versions 2.4.x through 2.4.1 Ambari Agent versions prior to 2.4.2

Description The issue allows custom commands to be executed on Ambari Agent hosts without proper authorization. This can lead to unauthorized access to certain operations that may impact the underlying system. These operations are invoked by the Ambari Agent process, running as the user who executes the Ambari Agent process.

Recommendations For Ambari Agent versions 2.4.x through 2.4.1, update to version 2.4.2 or later to resolve the issue. For Ambari Agent versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-6807

GHSA-J76Q-99X2-V7VQ

Affected Products

Ambari Agent

References · 7

• https://osv.dev/vulnerability/GHSA-j76q-99x2-v7vq · Vendor Advisory
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6807 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6807 · Vendor Advisory
• https://github.com/apache/ambari · Note
• https://web.archive.org/web/20200227181557/http://securityfocus.com/bid/97184 · Note
• http://securityfocus.com/bid/97184 · Note