CVE-2012-4449
CriticalSummary
Apache Hadoop versions before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled. This makes it easier for attackers to crack secret keys via a brute-force attack.
Risk Assessment
Organizations may be vulnerable to attacks that allow the compromise of secret keys, potentially leading to unauthorized access to systems secured by Kerberos.
Recommendation
It is recommended to upgrade Apache Hadoop to version 0.23.4, 1.0.4, or 2.0.2 or later to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.