Mailing-List: contact general-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
MIME-Version: 1.0
From: Yongjun Zhang <yjzhangal@apache.org>
Date: Mon, 28 Nov 2016 16:04:45 -0800
Message-ID: <CAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q@mail.gmail.com>
Subject: CVE-2016-5393: Apache Hadoop Privilege escalation vulnerability
To: security@apache.org, oss-security@lists.openwall.com,
	bugtraq@securityfocus.com, general@hadoop.apache.org
Content-Type: multipart/alternative; boundary=001a113ed16c04913805426556e2
archived-at: Tue, 29 Nov 2016 00:04:49 -0000

--001a113ed16c04913805426556e2
Content-Type: text/plain; charset=UTF-8

Hi,

Please see below the official announcement of a critical security
vulnerability that's discovered and subsequently fixed in Apache Hadoop
releases.

Thanks and best regards,

--Yongjun

----------

CVE-2016-5393: Apache Hadoop Privilege escalation vulnerability

Severity: Critical


Vendor:

The Apache Software Foundation


Versions Affected:

Hadoop 2.6.x, 2.7.x


Description:

A remote user who can authenticate with the HDFS NameNode can possibly run
arbitrary commands as the hdfs user.


Mitigation:

2.7.x users should upgrade to 2.7.3

2.6.x users should upgrade to 2.6.5


Impact:

A remote user who can authenticate with the HDFS NameNode can possibly run
arbitrary commands with the same privileges as HDFS service.


Credit:

This issue was discovered by Freddie Rice.

----------

--001a113ed16c04913805426556e2--