Description:
The UI daemon in Apache Storm 0.10.0-beta allows remote users to run
arbitrary code as the user running the web server. With kerberos
authentication this could allow impersonation of arbitrary users on other
systems, including HDFS and HBase.
Mitigation:
0.10.0-beta users should upgrade to 0.10.0-beta1 or disable the Storm UI
daemon.
Apache Storm 0.10.0-beta1 artifacts are available for immediate download here:
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Apache Storm 0.10.0-beta
Description:
The UI daemon in Apache Storm 0.10.0-beta allows remote users to run
arbitrary code as the user running the web server. With kerberos
authentication this could allow impersonation of arbitrary users on other
systems, including HDFS and HBase.
Mitigation:
0.10.0-beta users should upgrade to 0.10.0-beta1 or disable the Storm UI
daemon.
Apache Storm 0.10.0-beta1 artifacts are available for immediate download here:
http://www.us.apache.org/dist/storm/apache-storm-0.10.0-beta1/
Credit:
This issue was discovered by Bobby Evans of the Apache Storm PMC
References:
https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md
https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md
P. Taylor Goetz
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQEcBAEBCgAGBQJVhN+NAAoJEI3gOWLoC4/9tIEIALzvPMDFWn7tfkAmSLQZGXrp
IMxieb4XY+zvAiTLmU/1c2w6xHLlDEDGWMRixzRSShST7vz+gMhXBhkmys6Bu583
Tex6dTFVE6LZIsNj0/ZU6ZzuWXukBU6WZgHh5QbIvLQK0e7SbVyuLN7M1btpEy6i
JWnWMzRflK3lLt+GJGvIVGrSnHHxxRu/sXxo2uNtErvxKRMYdb+aK0V/RCEOVQtu
xBV+HGoMZ4+CRa7vllnTkvTS8LbAegDO940PH3sS1FikfPC8J1LEiG0zjaV3z4EY
8i0E+0rb30kLSBPIzvoa/z2WtmywbZfAQ91O8pYreRKp8RWKQAksGyut30XmFFw=
=R9V8
-----END PGP SIGNATURE-----
[ reply ]