CVE:CVE-2012-1574
CNNVD:CNNVD-201204-102
Apache Hadoop 0.20.203.0到0.20.205.0版本、0.23.2之前的0.23.x版本和1.0.2之前的1.0.x版本中的Kerberos/MapReduce安全函数被用于Cloudera CDH CDH3u0到CDH3u2版本、0.20.2+923.197之前的Cloudera hadoop-0.20-sbin版本及其他产品中时存在漏洞。远程认证用户可利用该漏洞借助未明向量模拟任意用户并执行非法操作。
solution:Upgrade apache hadoop to a higher version than 0.20.203.0,0.20.204.0,0.20.205.0,0.23.0,0.23.1,1.0.0,1.0.1,and avoid the version 0.20.203.0,0.20.204.0,0.20.205.0,0.23.0,0.23.1,1.0.0,1.0.1; Upgrade cloudera cloudera_cdh to a higher version than cdh3:0,cdh3:1,cdh3:2,and avoid the version cdh3:0,cdh3:1,cdh3:2; Upgrade cloudera hadoop to a higher version than 0.20-sbin,0.20.1+169,0.20.2+923,and avoid the version 0.20-sbin,0.20.1+169,0.20.2+923