Security restrictions bypass in Hadoop - CVE-2020-9492

Vulnerability identifier: #VU50000

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9492

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the way Apache Hadoop handles SPNEGO authorization headers. A remote WebHDFS client can trigger services to send server credentials to a webhdfs path for capturing the service principal.

Hadoop
Red Hat Integration Camel Extensions for Quarkus
Red Hat Integration Camel-K
QRadar User Behavior Analytics
IBM Cloud Application Performance Management (APM)
DataStage on Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
IBM Qradar SIEM
Oracle Financial Services Crime and Compliance Management Studio
Primavera Unifier
openEuler
watsonx.data
hadoop-httpfs
hadoop-mapreduce
hadoop-debugsource
hadoop-devel
hadoop-debuginfo
hadoop-yarn-security
hadoop-common-native
libhdfs
hadoop
hadoop-common
hadoop-maven-plugin
hadoop-yarn
hadoop-hdfs
hadoop-mapreduce-examples
hadoop-client
hadoop-tests

Install updates from vendor's website.

Hadoop - addressed in versions 2.10.1, 3.1.4, 3.2.2
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 10, 7.4.3 Fix Pack 3, 7.4.3 Fix Pack 4
Red Hat Integration Camel-K - update to 1.8
watsonx.data - update to 2.0.2
hadoop-httpfs - update to 3.2.1-7
hadoop-mapreduce - update to 3.2.1-7
hadoop-debugsource - update to 3.2.1-7
hadoop-devel - update to 3.2.1-7
hadoop-debuginfo - update to 3.2.1-7
hadoop-yarn-security - update to 3.2.1-7
hadoop-common-native - update to 3.2.1-7
libhdfs - update to 3.2.1-7
hadoop - update to 3.2.1-7
hadoop-common - update to 3.2.1-7
hadoop-maven-plugin - update to 3.2.1-7
hadoop-yarn - update to 3.2.1-7
hadoop-hdfs - update to 3.2.1-7
hadoop-mapreduce-examples - update to 3.2.1-7
hadoop-client - update to 3.2.1-7
hadoop-tests - update to 3.2.1-7
IBM Cloud Pak for Watson AIOps - update to 3.7.1
QRadar User Behavior Analytics - update to 4.1.9
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.1

• http://seclists.org/oss-sec/2021/q1/69

• Privilege escalation in Apache Hadoop
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 2.7
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler 20.03 LTS SP1 update for hadoop
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data