PT-2018-3335 · Apache · Apache Hadoop

Wilfred Spiegelenburg · Published 2018-11-27 · Updated 2019-10-03 · CVE-2018-11766

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 2.7.4 through 2.7.6

Description: The issue is related to insecure privilege management in Apache Hadoop, allowing a remote attacker to execute arbitrary commands with root privileges. A user who can escalate to the yarn user may possibly run arbitrary commands as the root user.

Recommendations: For Apache Hadoop versions 2.7.4 through 2.7.6, consider restricting access to the yarn user to minimize the risk of exploitation until a complete security fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-268

Related Identifiers

BDU:2019-04871

CVE-2018-11766

GHSA-RQJ9-CQ6J-958R

Affected Products

Apache Hadoop

References · 10

• https://osv.dev/vulnerability/GHSA-rqj9-cq6j-958r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11766 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11766 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04871 · Security Note
• http://securityfocus.com/bid/106035 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1654239 · Note
• https://lists.apache.org/thread.html/ff37bbbe09d5f03090e2dd2c3dea95de16ef4249e731f19b8959ce4c@%3Cgeneral.hadoop.apache.org%3E · Note
• https://securitylab.ru/vulnerability/496743.php · Note
• https://github.com/advisories/GHSA-rqj9-cq6j-958r · Note
• https://lists.apache.org/thread.html/ff37bbbe09d5f03090e2dd2c3dea95de16ef4249e731f19b8959ce4c%40%3Cgeneral.hadoop.apache.org%3E · Note