Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hbase | Apache | 0.92.0 (including) | 0.92.0 (including) |
| Hbase | Apache | 0.92.1 (including) | 0.92.1 (including) |
| Hbase | Apache | 0.92.2 (including) | 0.92.2 (including) |
| Hbase | Apache | 0.94.0 (including) | 0.94.0 (including) |
| Hbase | Apache | 0.94.1 (including) | 0.94.1 (including) |
| Hbase | Apache | 0.94.2 (including) | 0.94.2 (including) |
| Hbase | Apache | 0.94.3 (including) | 0.94.3 (including) |
| Hbase | Apache | 0.94.4 (including) | 0.94.4 (including) |
| Hbase | Apache | 0.94.5 (including) | 0.94.5 (including) |
| Hbase | Apache | 0.94.6 (including) | 0.94.6 (including) |
| Hbase | Apache | 0.94.6.1 (including) | 0.94.6.1 (including) |
| Hbase | Apache | 0.94.7 (including) | 0.94.7 (including) |
| Hbase | Apache | 0.94.8 (including) | 0.94.8 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- http://osvdb.org/96615
- http://seclists.org/fulldisclosure/2013/Aug/250
- https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
- http://osvdb.org/96615
- http://seclists.org/fulldisclosure/2013/Aug/250
- https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html