CVE-2015-1772 Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
HighCVSS 7.3
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hive/hive(Maven) | >= 1.0.0, < 1.0.1 | 1.0.1 |
| org.apache.hive/hive(Maven) | = 1.0.0 | No fix listed |
| org.apache.hive/hive(Maven) | >= 1.1.0, < 1.1.1 | 1.1.1 |
| org.apache.hive/hive(Maven) | = 1.1.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | >= 1.0.0, < 1.0.1 | 1.0.1 |
| org.apache.hive/hive-exec(Maven) | = 1.0.0 | No fix listed |
| org.apache.hive/hive-exec(Maven) | >= 1.1.0, < 1.1.1 | 1.1.1 |
| org.apache.hive/hive-exec(Maven) | = 1.1.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | >= 1.0.0, < 1.0.1 | 1.0.1 |
| org.apache.hive/hive-service(Maven) | = 1.0.0 | No fix listed |
| org.apache.hive/hive-service(Maven) | >= 1.1.0, < 1.1.1 | 1.1.1 |
| org.apache.hive/hive-service(Maven) | = 1.1.0 | No fix listed |
| ibm infosphere biginsights | = 3.0.0.0 | No fix listed |
| ibm infosphere biginsights | = 3.0.0.1 | No fix listed |
| ibm infosphere biginsights | = 3.0.0.2 | No fix listed |
| apache hive | = 1.0.0 | No fix listed |
| apache hive | = 1.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- www.cloudera.com
- mail-archives.apache.org
- www-01.ibm.com vendor-advisory
- 1034365 vdb-entry
- [www-announce] 20150521 CVE-2015-1772 mailing-list