CVE-2016-5393: Improper Access Control in Apache Hadoop
Summary
CVE-2016-5393: Improper Access Control in Apache Hadoop. Affects org.apache.hadoop:hadoop-common across 2 version ranges.
>= 2.6.0, < 2.6.5
>= 2.7.0, < 2.7.3
Fixed in 2.6.5 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The 'hadoop-common' package is a core component of Apache Hadoop, responsible for providing common utilities and libraries. However, versions 2.6.x before 2.6.5 and 2.7.x before 2.7.3 of 'hadoop-common' are vulnerable to an improper access control issue.
Vulnerability Detail
The vulnerability (CVE-2016-5393) allows a remote user who can authenticate with the HDFS NameNode to execute arbitrary commands with the same privileges as the HDFS service. This means that an attacker with access to the HDFS NameNode can potentially gain unauthorized control over the Hadoop cluster and perform malicious actions. The vulnerability has a CVSS score of 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It is classified under CWE-284 (Improper Access Control).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.6.52.6.5 -
>= 2.7.0, < 2.7.32.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of Apache Hadoop.
Conclusion
The vulnerability in Apache Hadoop (CVE-2016-5393) poses a significant risk to the security and integrity of Hadoop clusters. It is crucial to upgrade to the fixed versions of 'hadoop-common' (2.6.5 or 2.7.3) to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-common →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
'hadoop-common' is a core component of Apache Hadoop, responsible for providing common utilities and libraries.
The vulnerability allows a remote user to run arbitrary commands with the same privileges as the HDFS service, potentially leading to unauthorized control over the Hadoop cluster.
To fix this vulnerability, upgrade to the fixed versions of Apache Hadoop (2.6.5 for 2.6.x and 2.7.3 for 2.7.x).
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-common.
