IBM Support

Security Bulletin: Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials (CVE-2015-1772, CVE-2015-1836).

Security Bulletin


Summary

Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials (CVE-2015-1772 , CVE-2015-1836).

Vulnerability Details

CVEID: CVE-2015-1772
DESCRIPTION:
Apache Hive could allow a remote attacker to bypass security restrictions, caused by an error in the HiveServer2 interface. If HiveServer2 is configured to use LDAP authentication mode and the configuration permits simple unauthenticated or anonymous binds, an attacker could exploit this vulnerability to authenticate with improper credentials.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com//vulnerabilities/103333 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-1836
DESCRIPTION:
Apache HBase could allow a remote attacker to gain unauthorized access to the system, caused by a logic error that allows the handling of ZooKeeper via insecure ACLs. An attacker with access to the ZooKeeper quorum could exploit this vulnerability to read or write HBase data or completely stop availability.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com//vulnerabilities/103332 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Affected Products and Versions

IBM InfoSphere BigInsights: 3.0, 3.0.0.1, 3.0.0.2

Remediation/Fixes

For affected versions, apply the interim fix on Fix Central for IM-BigInsights-BigSQL-linuxamd64_CVE-2015-1772_CVE-2015-1836

Get Notified about Future Security Bulletins

References

Off

Change History

1 December 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Product":{"code":"SSPT3X","label":"IBM BigInsights"},"Business Unit":{"code":"BU001","label":"Analytics Private Cloud"},"Component":"Open Source Tools","Platform":[{"code":"PF016","label":"Linux"}],"Version":"3.0;3.0.0.2;3.0.0.1","Edition":"Enterprise Edition"}]

Document Information

Modified date:
16 June 2018

UID

swg21969546