Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.
Weakness
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
Affected Software
| Name |
Vendor |
Start Version |
End Version |
| Hadoop |
Apache |
* |
0.23.3 |
| Hadoop |
Apache |
1.0.0 |
1.0.0 |
| Hadoop |
Apache |
1.0.1 |
1.0.1 |
| Hadoop |
Apache |
1.0.2 |
1.0.2 |
| Hadoop |
Apache |
1.0.3 |
1.0.3 |
| Hadoop |
Apache |
2.0.0 |
2.0.0 |
| Hadoop |
Apache |
2.0.1 |
2.0.1 |
| Hadoop |
Apache |
2.0.2 |
2.0.2 |
Potential Mitigations
- When there is a need to store or transmit sensitive data, use strong, up-to-date cryptographic algorithms to encrypt that data. Select a well-vetted algorithm that is currently considered to be strong by experts in the field, and use well-tested implementations. As with all cryptographic mechanisms, the source code should be available for analysis.
- For example, US government systems require FIPS 140-2 certification.
- Do not develop custom or private cryptographic algorithms. They will likely be exposed to attacks that are well-understood by cryptographers. Reverse engineering techniques are mature. If the algorithm can be compromised if attackers find out how it works, then it is especially weak.
- Periodically ensure that the cryptography has not become obsolete. Some older algorithms, once thought to require a billion years of computing time, can now be broken in days or hours. This includes MD4, MD5, SHA1, DES, and other algorithms that were once regarded as strong. [REF-267]
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Industry-standard implementations will save development time and may be more likely to avoid errors that can occur during implementation of cryptographic algorithms. Consider the ESAPI Encryption feature.
References