SB2016112906 - Multiple vulnerabilities in Hadoop

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016112906

SB2016112906 - Multiple vulnerabilities in Hadoop

Published: November 29, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016112906
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2016-3086)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.


2) Improper access control (CVE-ID: CVE-2016-5393)

The vulnerability allows a remote authenticated user to execute arbitrary code.

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.


Remediation

Install update from vendor's website.

References