The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
| Link | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2012/Apr/70 | mailing list |
| http://secunia.com/advisories/48775 | third party advisory |
| https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html | |
| http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html | mailing list |
| http://secunia.com/advisories/48776 | third party advisory |
| http://www.securityfocus.com/bid/52939 | vdb entry |
| https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin | vendor advisory |