Mailing-List: contact dev-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@hbase.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
References: 
 <CA+4052=hJd3M4Cs9c4=BktE8V3E8tzU88+TO9g7H5adpor+_zg@mail.gmail.com>
 <1333732314.10392.YahooMailNeo@web164502.mail.gq1.yahoo.com>
 <1333732358.60670.YahooMailNeo@web164501.mail.gq1.yahoo.com>
 <CAEGKEUMZo=sV7LXzc+xknoM7=-EAi7_Cj2cZbjA_7+YwjFHX3g@mail.gmail.com>
Message-ID: <1333733429.24030.YahooMailNeo@web164502.mail.gq1.yahoo.com>
Date: Fri, 6 Apr 2012 10:30:29 -0700 (PDT)
From: Andrew Purtell <apurtell@apache.org>
Reply-To: Andrew Purtell <apurtell@apache.org>
Subject: Re: Fw: [CVE-2012-1574] Apache Hadoop user impersonation
 vulnerability
To: "dev@hbase.apache.org" <dev@hbase.apache.org>
In-Reply-To: 
 <CAEGKEUMZo=sV7LXzc+xknoM7=-EAi7_Cj2cZbjA_7+YwjFHX3g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Thanks. =0A=0A=0AThe problem with that disclosure as written is it provided=
 no information as the the nature of the vulnerability. And, as you mention=
, the CVE is 404.=0A=0A> "Users affected: Users who have enabled Hadoop's K=
erberos/MapReduce security=A0 features."=0A=0AWell, we have enabled Hadoop'=
s Kerberos security features. The additional qualification of "MapReduce" i=
s there but there is insufficient context. So a broad reading is required. =
=0A=0A> "Impact: Vulnerability allows an authenticated malicious user to im=
personate=A0 any other user on the cluster."=0A=0AThe implication given the=
 lack of information is that Hadoop's Kerberos based authentication is wort=
hless.=0A=0AThankfully that is not the case, and HBase is not affected.=0A=
=A0=0ABest regards,=0A=0A=0A=A0 =A0 - Andy=0A=0AProblems worthy of attack p=
rove their worth by hitting back. - Piet Hein (via Tom White)=0A=0A=0A=0A--=
--- Original Message -----=0A> From: Joey Echeverria <joey@cloudera.com>=0A=
> To: dev@hbase.apache.org; Andrew Purtell <apurtell@apache.org>=0A> Cc: =
=0A> Sent: Friday, April 6, 2012 10:19 AM=0A> Subject: Re: Fw: [CVE-2012-15=
74] Apache Hadoop user impersonation vulnerability=0A> =0A> I'm not sure wh=
y the CVE isn't published yet, but the details are=0A> available here:=0A> =
=0A> https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin=0A> =
=0A> -Joey=0A> =0A> On Fri, Apr 6, 2012 at 10:12 AM, Andrew Purtell <apurte=
ll@apache.org> =0A> wrote:=0A>>  Failed to CC dev@, my apologies.=0A>> =0A>=
> =0A>> =0A>>  ----- Forwarded Message -----=0A>> =0A>>>  From: Andrew Purt=
ell <apurtell@apache.org>=0A>>>  To: "user@hbase.apache.org" <user@hbase.ap=
ache.org>=0A>>>  Cc:=0A>>>  Sent: Friday, April 6, 2012 10:11 AM=0A>>>  Sub=
ject: Fw: [CVE-2012-1574] Apache Hadoop user impersonation =0A> vulnerabili=
ty=0A>>> =0A>>>  Details of the below vulnerability have not been released.=
=0A>>> =0A>>>  Given that HBase security has as its foundation Apache Hadoo=
p =0A> authentication, at=0A>>>  this time we must assume any secure HBase =
deployment is equally =0A> vulnerable.=0A>>> =0A>>>  I will update you when=
 more information is available.=0A>>> =0A>>> =0A>>>  Best regards,=0A>>> =
=0A>>> =0A>>>  =A0 =A0 - Andy=0A>>> =0A>>>  Problems worthy of attack prove=
 their worth by hitting back. - Piet =0A> Hein (via=0A>>>  Tom White)=0A>>>=
 =0A>>> =0A>>> =0A>>>  ----- Forwarded Message -----=0A>>>>  =A0From: Aaron=
 T. Myers <atm@cloudera.com>=0A>>>>  =A0To: general@hadoop.apache.org; secu=
rity@apache.org;=0A>>>  full-disclosure@lists.grok.org.uk; bugtraq@security=
focus.com=0A>>>>  =A0Cc:=0A>>>>  =A0Sent: Thursday, April 5, 2012 7:31 PM=
=0A>>>>  =A0Subject: [CVE-2012-1574] Apache Hadoop user impersonation =0A> =
vulnerability=0A>>>> =0A>>>>  =A0Hello,=0A>>>> =0A>>>>  =A0Users of Apache =
Hadoop should be aware of a security vulnerability =0A> recently=0A>>>>  =
=A0discovered, as described by the following CVE. In particular, =0A> pleas=
e note=0A>>>>  =A0the "Users affected", "Versions affected", and=0A>>>>  =
=A0"Mitigation" sections.=0A>>>> =0A>>>>  =A0Best,=0A>>>>  =A0Aaron=0A>>>> =
=0A>>>>  =A0--=0A>>>>  =A0Aaron T. Myers=0A>>>>  =A0Software Engineer, Clou=
dera=0A>>>> =0A>>>>  =A0CVE-2012-1574: Apache Hadoop user impersonation vul=
nerability=0A>>>> =0A>>>>  =A0Severity: Critical=0A>>>> =0A>>>>  =A0Vendor:=
 The Apache Software Foundation=0A>>>> =0A>>>>  =A0Versions Affected:=0A>>>=
>  =A0Hadoop 0.20.203.0, 0.20.204.0, and 0.20.205.0=0A>>>>  =A0Hadoop 1.0.0=
 to 1.0.1=0A>>>>  =A0Hadoop 0.23.0 to 0.23.1.=0A>>>> =0A>>>>  =A0Users affe=
cted: Users who have enabled Hadoop's =0A> Kerberos/MapReduce=0A>>>  securi=
ty=0A>>>>  =A0features.=0A>>>> =0A>>>>  =A0Impact: Vulnerability allows an =
authenticated malicious user to =0A> impersonate=0A>>>>  =A0any other user =
on the cluster.=0A>>>> =0A>>>>  =A0Mitigation:=0A>>>>  =A00.20.20x.x and 1.=
0.x users should upgrade to 1.0.2=0A>>>>  =A00.23.x users should upgrade to=
 0.23.2 when it becomes available=0A>>>> =0A>>>>  =A0Credit:=0A>>>>  =A0Thi=
s issue was discovered by Aaron T. Myers of Cloudera.=0A>>>> =0A>>> =0A> =
=0A> =0A> =0A> -- =0A> Joey Echeverria=0A> Senior Solutions Architect=0A> C=
loudera, Inc.=0A>