#VU38924 Input validation error in Hadoop - CVE-2017-7669

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU38924

#VU38924 Input validation error in Hadoop - CVE-2017-7669

Published: June 5, 2017 / Updated: August 8, 2020


Vulnerability identifier: #VU38924
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-7669
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Hadoop
Software vendor:
Apache Foundation

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.


Remediation

Install update from vendor's website.

External links