Mailing-List: contact dev-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@hbase.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
References: 
 <CA+4052=hJd3M4Cs9c4=BktE8V3E8tzU88+TO9g7H5adpor+_zg@mail.gmail.com>
 <1333732314.10392.YahooMailNeo@web164502.mail.gq1.yahoo.com>
Message-ID: <1333732358.60670.YahooMailNeo@web164501.mail.gq1.yahoo.com>
Date: Fri, 6 Apr 2012 10:12:38 -0700 (PDT)
From: Andrew Purtell <apurtell@apache.org>
Reply-To: Andrew Purtell <apurtell@apache.org>
Subject: Fw: [CVE-2012-1574] Apache Hadoop user impersonation vulnerability
To: "dev@hbase.apache.org" <dev@hbase.apache.org>
In-Reply-To: <1333732314.10392.YahooMailNeo@web164502.mail.gq1.yahoo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Failed to CC dev@, my apologies.=0A=0A=A0=0A=0A----- Forwarded Message ----=
-=0A=0A> From: Andrew Purtell <apurtell@apache.org>=0A> To: "user@hbase.apa=
che.org" <user@hbase.apache.org>=0A> Cc: =0A> Sent: Friday, April 6, 2012 1=
0:11 AM=0A> Subject: Fw: [CVE-2012-1574] Apache Hadoop user impersonation v=
ulnerability=0A> =0A> Details of the below vulnerability have not been rele=
ased.=0A> =0A> Given that HBase security has as its foundation Apache Hadoo=
p authentication, at =0A> this time we must assume any secure HBase deploym=
ent is equally vulnerable.=0A> =0A> I will update you when more information=
 is available.=0A> =0A> =0A> Best regards,=0A> =0A> =0A> =A0 =A0 - Andy=0A>=
 =0A> Problems worthy of attack prove their worth by hitting back. - Piet H=
ein (via =0A> Tom White)=0A> =0A> =0A> =0A> ----- Forwarded Message -----=
=0A>>  From: Aaron T. Myers <atm@cloudera.com>=0A>>  To: general@hadoop.apa=
che.org; security@apache.org; =0A> full-disclosure@lists.grok.org.uk; bugtr=
aq@securityfocus.com=0A>>  Cc: =0A>>  Sent: Thursday, April 5, 2012 7:31 PM=
=0A>>  Subject: [CVE-2012-1574] Apache Hadoop user impersonation vulnerabil=
ity=0A>> =0A>>  Hello,=0A>> =0A>>  Users of Apache Hadoop should be aware o=
f a security vulnerability recently=0A>>  discovered, as described by the f=
ollowing CVE. In particular, please note=0A>>  the "Users affected", "Versi=
ons affected", and =0A>>  "Mitigation" sections.=0A>> =0A>>  Best,=0A>>  Aa=
ron=0A>> =0A>>  --=0A>>  Aaron T. Myers=0A>>  Software Engineer, Cloudera=
=0A>> =0A>>  CVE-2012-1574: Apache Hadoop user impersonation vulnerability=
=0A>> =0A>>  Severity: Critical=0A>> =0A>>  Vendor: The Apache Software Fou=
ndation=0A>> =0A>>  Versions Affected:=0A>>  Hadoop 0.20.203.0, 0.20.204.0,=
 and 0.20.205.0=0A>>  Hadoop 1.0.0 to 1.0.1=0A>>  Hadoop 0.23.0 to 0.23.1.=
=0A>> =0A>>  Users affected: Users who have enabled Hadoop's Kerberos/MapRe=
duce =0A> security=0A>>  features.=0A>> =0A>>  Impact: Vulnerability allows=
 an authenticated malicious user to impersonate=0A>>  any other user on the=
 cluster.=0A>> =0A>>  Mitigation:=0A>>  0.20.20x.x and 1.0.x users should u=
pgrade to 1.0.2=0A>>  0.23.x users should upgrade to 0.23.2 when it becomes=
 available=0A>> =0A>>  Credit:=0A>>  This issue was discovered by Aaron T. =
Myers of Cloudera.=0A>> =0A>