CVE-2015-1776

Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.

CVSS v3 6.2 MEDIUM
CVSS v2.0 2.1 LOW

6.2^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E
http://www.securityfocus.com/bid/83259

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:hadoop:2.6.0:::::::*
	cpe:2.3:a:apache:hadoop:2.6.1:::::::*
	cpe:2.3:a:apache:hadoop:2.6.2:::::::*
	cpe:2.3:a:apache:hadoop:2.6.3:::::::*
	cpe:2.3:a:apache:hadoop:2.6.4:::::::*

History

No history.

Information

Published : 2016-04-19 21:59

Updated : 2023-11-07 02:24

NVD link : CVE-2015-1776

Mitre link : CVE-2015-1776

CVE.ORG link : CVE-2015-1776

JSON object : View

Products Affected

apache

hadoop

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-1776", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "published": "2016-04-19T21:59:02.100", "references": [{"url": "http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E", "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/83259", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file."}, {"lang": "es", "value": "Apache Hadoop 2.6.x cifra los datos intermedios generados por una tarea MapReduce y los almacena junto con la clave de cifrado en un archivo de credenciales en disco cuando la funcionalidad de cifrado de datos Intermediate est\u00e1 habilitada, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura del archivo."}], "lastModified": "2023-11-07T02:24:55.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:hadoop:2.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25EA1A6B-46EF-4157-854A-8991158D8A56"}, {"criteria": "cpe:2.3:a:apache:hadoop:2.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "569A25D2-6BAE-4AF3-B5A4-E578F5BF4000"}, {"criteria": "cpe:2.3:a:apache:hadoop:2.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0303DDA4-A5C1-4358-A4DC-F85C1B2E3254"}, {"criteria": "cpe:2.3:a:apache:hadoop:2.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68F54CBB-0D44-4F8F-A45D-330213E0C349"}, {"criteria": "cpe:2.3:a:apache:hadoop:2.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97B60011-6E60-4DBC-957B-C1F1CBB2B777"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}