BugTraq
[CVE-2015-3188] Apache Storm remote code execution vulnerability Jun 20 2015 03:35AM
P. Taylor Goetz (ptgoetz apache org)
CVE-2015-3188: Apache Storm remote code execution vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Storm 0.10.0-beta

Description:
The UI daemon in Apache Storm 0.10.0-beta allows remote users to run
arbitrary code as the user running the web server. With kerberos
authentication this could allow impersonation of arbitrary users on other
systems, including HDFS and HBase.

Mitigation:
0.10.0-beta users should upgrade to 0.10.0-beta1 or disable the Storm UI
daemon.

Apache Storm 0.10.0-beta1 artifacts are available for immediate download here:

http://www.us.apache.org/dist/storm/apache-storm-0.10.0-beta1/

Credit:
This issue was discovered by Bobby Evans of the Apache Storm PMC

References:
https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md
https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md

P. Taylor Goetz
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQEcBAEBCgAGBQJVhN+NAAoJEI3gOWLoC4/9tIEIALzvPMDFWn7tfkAmSLQZGXrp
IMxieb4XY+zvAiTLmU/1c2w6xHLlDEDGWMRixzRSShST7vz+gMhXBhkmys6Bu583
Tex6dTFVE6LZIsNj0/ZU6ZzuWXukBU6WZgHh5QbIvLQK0e7SbVyuLN7M1btpEy6i
JWnWMzRflK3lLt+GJGvIVGrSnHHxxRu/sXxo2uNtErvxKRMYdb+aK0V/RCEOVQtu
xBV+HGoMZ4+CRa7vllnTkvTS8LbAegDO940PH3sS1FikfPC8J1LEiG0zjaV3z4EY
8i0E+0rb30kLSBPIzvoa/z2WtmywbZfAQ91O8pYreRKp8RWKQAksGyut30XmFFw=
=R9V8
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus