PT-2018-3331 · Apache · Apache Hadoop

Published 2018-11-13 · Updated 2020-10-08 · CVE-2018-8009

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 3.1.0, 3.0.0-alpha through 3.0.2, 2.9.0 through 2.9.1, 2.8.0 through 2.8.4, 2.0.0-alpha through 2.7.6, 0.23.0 through 0.23.11

Description: The issue exists due to incorrect restriction of the directory path name with limited access in the YARN NodeManager component of the Apache Hadoop platform. This allows a remote attacker to bypass existing security restrictions and inject malicious code into a zip file. The vulnerability is exploitable in places that accept a zip file via the zip slip vulnerability.

Recommendations: For Apache Hadoop versions 3.1.0, 3.0.0-alpha through 3.0.2, 2.9.0 through 2.9.1, 2.8.0 through 2.8.4, 2.0.0-alpha through 2.7.6, 0.23.0 through 0.23.11, consider restricting access to zip files until a patch is available. As a temporary workaround, consider disabling the acceptance of zip files in the YARN NodeManager component until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-04864

CVE-2018-8009

GHSA-6X48-J4X4-CQW3

Affected Products

Apache Hadoop

References · 24

• 🔥 https://snyk.io/research/zip-slip-vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8009 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3892 · Vendor Advisory
• https://hadoop.apache.org/cve_list.html#cve-2018-8009-http-cve-mitre-org-cgi-bin-cvename-cgi-name-cve-2018-8009-zip-slip-impact-on-apache-hadoop · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6x48-j4x4-cqw3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8009 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04864 · Security Note
• https://github.com/apache/hadoop · Note
• https://github.com/apache/hadoop/commit/45a1c680c276c4501402f7bc4cebcf85a6fbc7f · Note
• https://github.com/apache/hadoop/commit/12258c7cff8d32710fbd8b9088a930e3ce27432 · Note
• https://github.com/apache/hadoop/commit/fc4c20fc3469674cb584a4fb98bac7e3c2277c9 · Note
• https://github.com/apache/hadoop/commit/65e55097da2bb3f2fbdf9ba1946da25fe58bec9 · Note
• https://github.com/apache/hadoop/commit/6a4ae6f6eeed1392a4828a5721fa1499f65bdde · Note
• https://lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973f7f38d@%3Cuser.hadoop.apache.org%3E · Note
• https://lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973f7f38d%40%3Cuser.hadoop.apache.org%3E · Note