CVE-2015-1772

[Chao Sun <su...@apache.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2015-1772: Apache Hive Authentication vulnerability in HiveServer2

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: All versions of Apache Hive from 0.11.0 to 1.0.0, and
1.1.0 .

Users affected: Users who use LDAP authentication mode in HiveServer2 and
also have LDAP configured to allow simple unauthenticated or anonymous bind.

Description:
LDAP services are sometimes configured to allow simple unauthenticated
binds.
When HiveServer2 is configured to use LDAP authentication mode
(hive.server2.authentication configuration parameter is set to LDAP),
with such LDAP configurations, it can allow users without proper credentials
to get authenticated.

This is more easily reproducible when Kerberos authentication is also
enabled
 in the Apache Hadoop cluster.

Mitigation:
There are two options
1. Configure LDAP service to disallow unauthenticated binds. If the service
 allows anonymous binds, not having hive authorization checks enabled can
 also expose this vulnerability.

2. Update Hive installation to use an Authenticator with the fix. There are
 two options here -
   a. Users should upgrade to newer versions of Apache Hive with the
      fix, which includes 1.0.1, 1.1.1 and 1.2.0 .
   b. Users can download the ldap-fix.tar.gz being made available for
      download from the Apache Hive downloads page and follow instructions
      in the README.txt to use an LDAP authenticator that contains the fix
      with your existing Hive release.

Credit:
Thanks to Thomas Rega of CareerBuilder for reporting this issue.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVXmECAAoJEN3RdT/2ztzmBDsP/inSE3VaTc7gLJf03MbjtoBX
bxrnWGpJir7IVe1nrlj2WiD8i4m/TqG5OoHZB2ZCnVOKbjngh6Mq4ldXM4lzGemN
6aDYW6gIdplwhiiKoVeNrTISl38whPlNO9Kp8Y9nabSGFxBcngRIuWOq6KyOADra
PP9QMys7xB325JgrgEjS9Fxrtx8cGQK+cRDm/Fi5RCjQ0Q3VRmSKVzcbg2jDmyR/
38P67SlZm4w37Z8hrBKakTQ2ql2dkmCSjnlIQCB1dln4iLp6VR2S7sizeYSvk4aQ
86BqORYYwXAmWeUfhUBlbBbLmeicu4VTvhKB2wYkD2G0TBIqXk90GVf5mdwDLir0
gk0R+gfv6YF89pmFVFjwerkLozjKs43Vx5NjQz1IxCeXnoUOw5n6gVC1kFgvnL2o
SYIRqa0+nn1ARf9ssodzffnCsm3QGPMtgy3L+iBiWY6vfI+zgWBhOeFcnlNWieqV
epxn5Q5ojjlwAwKQ7irco3uULiBu+f/CIYq2ey4I8a8qNLHQRs9n850E/3MYaV5o
PmHdu2Gmuvj216fyS+5OuROAjFeuPPDq+qzRVOcISXnCfxzFjXL2PWvPc/RyMN1d
g82gMzwczv8EFhag5MdD5FMyqAxz8BKdeOaKk/QGPQG1XvlGqjuDKJYDCfsHI4F/
5mUttG40ky0zn3ONQAPC
=7NKg
-----END PGP SIGNATURE-----