PT-2016-6406 · Apache · Apache Hadoop

Freddie Rice

·

CVE-2016-5393

·

Publicado

2016-11-29

·

Atualizado

2022-05-17

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.6.x through 2.6.4 Apache Hadoop versions 2.7.x through 2.7.2
Description A remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
Recommendations For Apache Hadoop versions 2.6.x through 2.6.4, update to version 2.6.5 or later. For Apache Hadoop versions 2.7.x through 2.7.2, update to version 2.7.3 or later.

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-5393
GHSA-7Q56-MP4C-GGGG

Produtos afetados

Apache Hadoop