CVE-2015-1836: Apache HBase remote denial of service, information integrity, and information disclosure vulnerability

[Andrew Purtell <ap...@apache.org>]

CVE-2015-1836: Apache HBase remote denial of service, information
integrity, and information disclosure vulnerability.

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:

HBase 0.98.0 - 0.98.12
HBase 1.0.0 - 1.0.1
HBase 1.1.0

The unsupported HBase 0.96 versions are also affected.

Description:

A logic error caused HBase in most secure configuration deployments to
handle its coordination state in ZooKeeper via insecure ACLs. Anyone with
remote unauthenticated network access to the ZooKeeper quorum, which by
definition includes all HBase clients, can make use of this opening to
degrade or completely stop availability. Any user with the authentication
credentials needed to connect to the HBase cluster as a normal user can, in
some configurations, read newly written HBase data that they are not
authorized to see. We believe it is possible for any user with
authentication credentials for the underlying HDFS cluster to write
arbitrary HBase data. Work to confirm this last attack vector is ongoing
and this announcement will be updated when we have more information.


Mitigation:

HBase users should update to the latest hotfix release of their respective
version (e.g. 0.98.12.1, 1.0.1.1, 1.1.0.1) to ensure newly written
coordination information has the correct ACLs. Any of these hotfix upgrades
can be done via a zero downtime rolling upgrade[1]. Because this logic bug
can mask some configuration errors, users are encouraged to verify their
deployments prior to starting the upgrade process[2].

Once on an appropriate version, users *must* run through the following
sequence of ZooKeeper commands via the ZooKeeper cli as the hbase service
account. For more information on using the ZooKeeper cli in a secure set
up, refer to the ZooKeeper documentation[3].

    setAcl /hbase world:anyone:r,sasl:hbase:cdrwa
    setAcl /hbase/backup-masters sasl:hbase:cdrwa
    setAcl /hbase/draining sasl:hbase:cdrwa
    setAcl /hbase/flush-table-proc sasl:hbase:cdrwa
    setAcl /hbase/hbaseid world:anyone:r,sasl:hbase:cdrwa
    setAcl /hbase/master world:anyone:r,sasl:hbase:cdrwa
    setAcl /hbase/meta-region-server world:anyone:r,sasl:hbase:cdrwa
    setAcl /hbase/namespace sasl:hbase:cdrwa
    setAcl /hbase/online-snapshot sasl:hbase:cdrwa
    setAcl /hbase/region-in-transition sasl:hbase:cdrwa
    setAcl /hbase/recovering-regions sasl:hbase:cdrwa
    setAcl /hbase/replication sasl:hbase:cdrwa
    setAcl /hbase/rs sasl:hbase:cdrwa
    setAcl /hbase/running sasl:hbase:cdrwa
    setAcl /hbase/splitWAL sasl:hbase:cdrwa
    setAcl /hbase/table sasl:hbase:cdrwa
    setAcl /hbase/table-lock sasl:hbase:cdrwa
    setAcl /hbase/tokenauth sasl:hbase:cdrwa


Credit:

This issue was discovered by Paul Codding and Enis Söztutar.


References:

1: http://hbase.apache.org/book.html#hbase.rolling.upgrade
2: http://hbase.apache.org/book.html#_external_zookeeper_configuration
3: http://s.apache.org/Rgo