{"id": "CVE-2017-5640", "bulletinFamily": "NVD", "title": "CVE-2017-5640", "description": "It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not). If the malicious server responds with 'COMPLETE' before the SASL handshake has completed, the client will consider the handshake as completed even though no exchange of credentials has happened.", "published": "2017-07-10T20:29:00", "modified": "2017-07-17T16:13:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5640", "reporter": "cve@mitre.org", "references": ["http://www.securityfocus.com/bid/99508", "https://lists.apache.org/thread.html/c02e83aa46c90b7cbc87dd649cf8f9b73e11053eddea9144a397da53@%3Cdev.impala.apache.org%3E"], "cvelist": ["CVE-2017-5640"], "type": "cve", "lastseen": "2020-10-03T13:07:45", "edition": 3, "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "zdt", "idList": ["1337DAY-ID-28113"]}], "modified": "2020-10-03T13:07:45", "rev": 2}, "score": {"value": 3.6, "vector": "NONE", "modified": "2020-10-03T13:07:45", "rev": 2}, "vulnersScore": 3.6}, "cpe": ["cpe:/a:apache:impala:2.7.0", "cpe:/a:apache:impala:2.8.0"], "affectedSoftware": [{"cpeName": "apache:impala", "name": "apache impala", "operator": "eq", "version": "2.8.0"}, {"cpeName": "apache:impala", "name": "apache impala", "operator": "eq", "version": "2.7.0"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "cpe23": ["cpe:2.3:a:apache:impala:2.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:impala:2.8.0:*:*:*:*:*:*:*"], "cwe": ["CWE-287"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:impala:2.7.0:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:impala:2.8.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}}

{"zdt": [{"lastseen": "2018-03-31T15:38:12", "description": "Apache Impala versions 2.7.0 through 2.8.0 suffers from an information disclosure vulnerability. It was noticed that a malicious process impersonating an Impala daemon could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not). If the malicious server responds with 'COMPLETE' before the SASL handshake has completed, the client will consider the handshake as completed even though no exchange of credentials has happened.", "edition": 1, "published": "2017-07-11T00:00:00", "type": "zdt", "title": "Apache Impala 2.8.0 Authentication Bypass Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-5640"], "modified": "2017-07-11T00:00:00", "href": "https://0day.today/exploit/description/28113", "id": "1337DAY-ID-28113", "sourceData": "CVE-2017-5640 Apache Impala (incubating) Information Disclosure\r\n\r\nVersions Affected:\r\nApache Impala (incubating) 2.7.0 to 2.8.0\r\n\r\nDescription:\r\nIt was noticed that a malicious process impersonating an Impala daemon\r\ncould cause Impala daemons to skip authentication checks when Kerberos\r\nis enabled (but TLS is not). If the malicious server responds with\r\naCOMPLETEa before the SASL handshake has completed, the client will\r\nconsider the handshake as completed even though no exchange of\r\ncredentials has happened.\r\n\r\nMitigation:\r\nUsers of the affected versions should apply the following mitigation:\r\nUpgrade to Apache Impala (incubating) 2.9.0\r\n\r\nCredit:\r\nThis issue was identified by the Cloudera Security team.\r\n\r\nReferences:\r\nhttps://issues.apache.org/jira/browse/IMPALA-5005\n\n# 0day.today [2018-03-31] #", "sourceHref": "https://0day.today/exploit/28113", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}