full-disclosure - CVE-2013-2192: Apache Hadoop Man in the Middle Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CA+4052kX8oqCeWFYeQ46LhrpYunE0vMu5Bmw-OidN9DPQMzzfw@mail.gmail.com>
Date: Fri, 23 Aug 2013 14:17:31 -0700
From: "Aaron T. Myers" <atm@...che.org>
To: user@...oop.apache.org, 
 "common-dev@...oop.apache.org" <common-dev@...oop.apache.org>,
 general@...oop.apache.org, 
 "security@...che.org" <security@...che.org>, full-disclosure@...ts.grok.org.uk,
 bugtraq <bugtraq@...urityfocus.com>
Subject: CVE-2013-2192: Apache Hadoop Man in the Middle
	Vulnerability

Hello,

Please see below for the official announcement of a serious security
vulnerability which has been discovered and subsequently fixed in Apache
Hadoop releases.

Best,
Aaron

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2013-2192: Apache Hadoop Man in the Middle Vulnerability

Severity: Severe

Vendor: The Apache Software Foundation

Versions Affected:
All versions of Hadoop 2.x prior to Hadoop 2.0.6-alpha.
All versions of Hadoop 0.23.x prior to Hadoop 0.23.9.
All versions of Hadoop 1.x prior to Hadoop 1.2.1.

Users affected: Users who have enabled Hadoop's Kerberos security features.

Impact: RPC traffic from clients, potentially including authentication
credentials, may be intercepted by a malicious user with access to run
tasks or containers on a cluster.

Description:
The Apache Hadoop RPC protocol is intended to provide bidirectional
authentication between clients and servers. However, a malicious server or
network attacker can unilaterally disable these authentication checks. This
allows for potential reduction in the configured quality of protection of
the RPC traffic, and privilege escalation if authentication credentials are
passed over RPC.

Mitigation:
Users of Hadoop 1.x versions should immediately upgrade to 1.2.1 or later.
Users of Hadoop 0.23.x versions should immediately upgrade to 0.23.9 or
later.
Users of Hadoop 2.x versions prior to 2.0.6-alpha should immediately
upgrade to 2.0.6-alpha or later.

Credit: This issue was discovered by Kyle Leckie of Microsoft and Aaron T.
Myers of Cloudera.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJSF84CAAoJECEaGfB4kTjfI7kH/0v4JJ992vGV4esnAKgNnTmn
A7GCj2zT7KFgF7ii6G6+5Xny9AnISTZWfMII/Szs5qaFgiaByvsNR5FoN+o5BS8s
vPWU8v5f3/cayacQgl8vxUiTlkXYZWQX+3V+8RTqAR3fPsr9IUMse4hOEcXvAjHr
 gDeWKiQaXRRhVjfmTLll1OWuKT8PmVar3qcbsg3vo/tj/yjOoVEfhV3DMOdIi+ES
pWtTxs5/fB8t+wA4hdY1r6trE7X6fys9NYC11jp83ej+ecjnHy7kmKGl41WESD+G
GOhAPYCMS9D29KGs2c6q0xCqi22R0klTs9d3Z/f7F5htGfBSAfAOpC6xPJ66/ZY=
 =4+in
-----END PGP SIGNATURE-----

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/