The vulnerability of the centralized service for supporting information about configuration, naming, distributed synchronization, and providing group services in Apache ZooKeeper makes it possible for a attacker to write arbitrary files to the operating system of the vulnerable device.

🗓️ 29 Oct 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Vulnerability in Apache ZooKeeper quorum joins allows arbitrary file writes due to no authentication.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM® Cloud Private (‪CVE-2018-8012)‬‬‬	20 Jul 201818:55	–	ibm
IBM Security Bulletins	Security Bulletin: InfoSphere Data Replication is affected by an Apache ZooKeeper open source library vulnerability	11 Feb 201916:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	24 Sep 202116:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities (CVE-2017-5637, CVE-2019-0201, CVE-2018-8012, CVE-2023-44981)	8 Oct 202418:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics	29 Apr 202501:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in zookeeper (CVE-2018-8012, CVE-2019-0201, CVE-2023-44981, CVE-2017-5637)	9 Jan 202603:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a public disclosed vulnerability from Apache ZooKeeper	13 Dec 201820:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Incident Forensics is vulnerable to Public disclosed vulnerability from Apache ZooKeeper (CVE-2018-8012)	4 Oct 201802:10	–	ibm

Vulners

Node

OR

apache zookeeperRange<3.4.10

apache zookeeperRange3.5.0–3.5.3

Source	Link
kb	www.kb.juniper.net/InfoCenter/index
lists	www.lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393@%3Cdev.zookeeper.apache.org%3E
debian	www.debian.org/security/2018/dsa-4214
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

27 Aug 2024 00:00Current

5.6Medium risk

Vulners AI Score5.6

CVSS 37.5

CVSS 27.8

EPSS0.08469

Apache ZooKeeper quorum authentication missing arbitrary file write remote exploitation