Return-Path: X-Original-To: apmail-announce-archive@www.apache.org Delivered-To: apmail-announce-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 1FA9017B14 for ; Mon, 25 May 2015 16:50:34 +0000 (UTC) Received: (qmail 52762 invoked by uid 500); 25 May 2015 16:50:17 -0000 Delivered-To: apmail-announce-archive@apache.org Received: (qmail 52274 invoked by uid 500); 25 May 2015 16:50:17 -0000 Mailing-List: contact announce-help@apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list announce@apache.org Delivered-To: moderator for announce@apache.org Received: (qmail 24718 invoked by uid 99); 25 May 2015 16:33:36 -0000 X-Received: by 10.202.73.8 with SMTP id w8mr12430395oia.55.1432571615793; Mon, 25 May 2015 09:33:35 -0700 (PDT) MIME-Version: 1.0 From: Andrew Purtell Date: Mon, 25 May 2015 09:32:54 -0700 Message-ID: Subject: CVE-2015-1836: Apache HBase remote denial of service, information integrity, and information disclosure vulnerability To: "user@hbase.apache.org" , user , announce@apache.org Cc: "dev@hbase.apache.org" , "dev@phoenix.apache.org" Content-Type: multipart/alternative; boundary=001a113db254465a9f0516ea926c --001a113db254465a9f0516ea926c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable CVE-2015-1836: Apache HBase remote denial of service, information integrity, and information disclosure vulnerability. Severity: Important Vendor: The Apache Software Foundation Versions Affected: HBase 0.98.0 - 0.98.12 HBase 1.0.0 - 1.0.1 HBase 1.1.0 The unsupported HBase 0.96 versions are also affected. Description: A logic error caused HBase in most secure configuration deployments to handle its coordination state in ZooKeeper via insecure ACLs. Anyone with remote unauthenticated network access to the ZooKeeper quorum, which by definition includes all HBase clients, can make use of this opening to degrade or completely stop availability. Any user with the authentication credentials needed to connect to the HBase cluster as a normal user can, in some configurations, read newly written HBase data that they are not authorized to see. We believe it is possible for any user with authentication credentials for the underlying HDFS cluster to write arbitrary HBase data. Work to confirm this last attack vector is ongoing and this announcement will be updated when we have more information. Mitigation: HBase users should update to the latest hotfix release of their respective version (e.g. 0.98.12.1, 1.0.1.1, 1.1.0.1) to ensure newly written coordination information has the correct ACLs. Any of these hotfix upgrades can be done via a zero downtime rolling upgrade[1]. Because this logic bug can mask some configuration errors, users are encouraged to verify their deployments prior to starting the upgrade process[2]. Once on an appropriate version, users *must* run through the following sequence of ZooKeeper commands via the ZooKeeper cli as the hbase service account. For more information on using the ZooKeeper cli in a secure set up, refer to the ZooKeeper documentation[3]. setAcl /hbase world:anyone:r,sasl:hbase:cdrwa setAcl /hbase/backup-masters sasl:hbase:cdrwa setAcl /hbase/draining sasl:hbase:cdrwa setAcl /hbase/flush-table-proc sasl:hbase:cdrwa setAcl /hbase/hbaseid world:anyone:r,sasl:hbase:cdrwa setAcl /hbase/master world:anyone:r,sasl:hbase:cdrwa setAcl /hbase/meta-region-server world:anyone:r,sasl:hbase:cdrwa setAcl /hbase/namespace sasl:hbase:cdrwa setAcl /hbase/online-snapshot sasl:hbase:cdrwa setAcl /hbase/region-in-transition sasl:hbase:cdrwa setAcl /hbase/recovering-regions sasl:hbase:cdrwa setAcl /hbase/replication sasl:hbase:cdrwa setAcl /hbase/rs sasl:hbase:cdrwa setAcl /hbase/running sasl:hbase:cdrwa setAcl /hbase/splitWAL sasl:hbase:cdrwa setAcl /hbase/table sasl:hbase:cdrwa setAcl /hbase/table-lock sasl:hbase:cdrwa setAcl /hbase/tokenauth sasl:hbase:cdrwa Credit: This issue was discovered by Paul Codding and Enis S=C3=B6ztutar. References: 1: http://hbase.apache.org/book.html#hbase.rolling.upgrade 2: http://hbase.apache.org/book.html#_external_zookeeper_configuration 3: http://s.apache.org/Rgo --001a113db254465a9f0516ea926c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
= CVE-2015-1836: Apache HBase rem= ote denial of service, information
integrity, and information dis= closure vulnerability.

Severity: Important=

Vendor: The Apache Software Foundation

Versions Affected:

HBase 0.98.0 - 0.98.12<= /font>
HBase 1.0.0 - 1.0.1
HBase 1.1.0

<= /div>
The unsupported HBase 0.96 versions are also affected.

Description:

A logic error caused HBase in= most secure configuration deployments to
handle its coordination= state in ZooKeeper via insecure ACLs. Anyone with
remote unaut= henticated network access to the ZooKeeper quorum, which by
defin= ition includes all HBase clients, can make use of this opening to
degrade or completely stop availability. Any user with the authentication<= /font>
credentials needed to connect to the HBase cluster as a normal us= er can, in
some configurations, read newly written HBase data tha= t they are not
authorized to see. We believe it is possible for a= ny user with
authentication credentials for the underlying HDFS c= luster to write
arbitrary HBase data. Work to confirm this last a= ttack vector is ongoing
and this announcement will be updated whe= n we have more information.


Mitigation:

HBase users should update to the latest hotfix release of their respective=
version (e.g. 0.98.12.1, 1.0.1.1, 1.1.0.1) to ensure newly w= ritten
coordination information has the correct ACLs. Any of thes= e hotfix upgrades
can be done via a zero downtime rolling upgrade= [1]. Because this logic bug
can mask some configuration errors, u= sers are encouraged to verify their
deployments prior to starting= the upgrade process[2].

Once on an appropriate ve= rsion, users *must* run through the following
sequence of ZooKeep= er commands via the ZooKeeper cli as the hbase service
account. F= or more information on using the ZooKeeper cli in a secure set
=
up= , refer to the ZooKeeper documentation[3].

=C2=A0 = =C2=A0 setAcl /hbase world:anyone:r,sasl:hbase:cdrwa
=C2=A0 =C2= =A0 setAcl /hbase/backup-masters sasl:hbase:cdrwa
=C2=A0 =C2=A0 s= etAcl /hbase/draining sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbas= e/flush-table-proc sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/h= baseid=C2=A0w= orld:anyone:r,sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/master= =C2=A0world:a= nyone:r,sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/meta-region-= server=C2=A0w= orld:anyone:r,sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/namesp= ace sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/online-snapshot = sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/region-in-transition= =C2=A0sasl:hb= ase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/recovering-regions=C2=A0sasl:hbase:cdrwa=
=C2=A0 =C2=A0 setAcl /hbase/replication sasl:hbase:cdrwa<= /div>
=C2=A0 =C2=A0 setAcl /hbase/rs sasl:hbase:cdrwa
=C2=A0 =C2= =A0 setAcl /hbase/running sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /= hbase/splitWAL sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/table= sasl:hbase:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/table-lock sasl:hba= se:cdrwa
=C2=A0 =C2=A0 setAcl /hbase/tokenauth sasl:hbase:cdrwa


Credit:

<= div class=3D"gmail_default">Thi= s issue was discovered by Paul Codding and Enis S=C3=B6ztutar.
=

References:

--001a113db254465a9f0516ea926c--