PT-2016-4406

Name of the Vulnerable Software and Affected Versions Apache Sentry versions prior to 1.7.0 Description The issue allows remote authenticated users to execute arbitrary code via the 1 reflect, 2 reflect2, or 3 java method Hive builtin functions. Recommendations For versions prior to 1.7.0, update...

Hive Built-in Function Arbitrary Code Execution Vulnerability

hive is a data warehouse tool based on Hadoop that maps structured data files to a single database table and provides simple sql query functionality that can convert sql statements into MapReduce tasks to run. Arbitrary code execution vulnerabilities exist in the 'reflect', 'reflect2' and...

FreeBSD : hive -- authorization logic vulnerability (a5c204b5-4153-11e6-8dfe-002590263bf5)

Sushanth Sowmyan reports : Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the...

with HIVE - Dynamic Code Loading, External URLs, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application with HIVE published at the 'play' market has multiple vulnerabilities...

Apache Hive authorization framework security bypass vulnerability

Apache Hive is a suite of Hadoop-based data warehouse software. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. authorization is one of the authorization framework. Apache Hive's authorization framework has a securi...

Authorization

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

CVE-2015-7521

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

CVE-2015-7521

The CVE-2015-7521 entry concerns Apache Hive (versions 1.0.0–1.2.1) run on clusters protected by Ranger and SqlStdHiveAuthorization. It describes an authorization bypass where partition-level operations can grant access that should be denied at the parent table level, effectively bypassing parent...

CVE-2015-7521

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

PT-2016-3802

Name of the Vulnerable Software and Affected Versions Apache Hive versions 1.0.0 through 1.2.1 Description The issue concerns the authorization framework, allowing attackers to bypass intended access restrictions on parent tables via partition-level operations, in clusters protected by Ranger and...

CVE-2015-7521: Improper Authentication

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

Authentication flaw

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

CVE-2015-1772

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

CVE-2015-1772

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

PT-2015-5437

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 1.0.1 Apache Hive versions 1.1.x prior to 1.1.1 IBM InfoSphere BigInsights versions 3.0, 3.0.0.1, and 3.0.0.2 Description The issue concerns the LDAP implementation in HiveServer2, which improperly handles simple...

CVE-2015-1772: Improper Authentication

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

Security Misconfiguration Vulnerability in the AWS SDK for PHP

SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. Aws\Ec2 - Added support for...

Hive 2.0 RC2 XSS / Code Execution / SQL Injection

| Title : Hive v2.0 RC2 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : "Powered by DigitalHive" | Tested on: windows 8.1 Français V.Pro | Bug : Stop Script | Download : http:///www.digitalhive.com ======================================= Stop SCript working :...

Apache Hive Authentication Vulnerability

Apache Hive is database software that facilitates querying and managing large data sets on distributed storage devices. Apache Hive versions 0.11.0-1.0.0, 1.1.0, the LDAP service is sometimes configured to allow unauthenticated bindings, and when HiveServer2 is configured to use LDAP authenticati...

CVE-2015-1889

The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via 1 a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or 2 an import of a certain Hive table definition with...