SB2017032815 - Improper access control in Ambari
Published: March 28, 2017 Updated: August 8, 2020
Security Bulletin ID
SB2017032815
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper access control (CVE-ID: CVE-2016-6807)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.
Remediation
Install update from vendor's website.