CVE-2012-4449
CriticalSummary
Apache Hadoop versions before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled. This makes it easier for attackers to crack secret keys via a brute-force attack.
Risk Assessment
Organizations may be vulnerable to attacks that allow the compromise of secret keys, potentially leading to unauthorized access to systems secured by Kerberos.
Recommendation
It is recommended to upgrade Apache Hadoop to version 0.23.4, 1.0.4, or 2.0.2 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Apache Hadoop
See all- CVE-2025-27821High
An out-of-bounds write vulnerability in Apache Hadoop HDFS native client. Affects Apache Hadoop from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
- CVE-2017-3166High
In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, files in encryption zones with world-readable permissions can be localized via YARN's localization mechanism, leading to their storage in a world-readable location.
- CVE-2017-7669High
In Apache Hadoop versions 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
- CVE-2017-3162High
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode query parameter is not validated in Apache Hadoop before 2.7.0.
- CVE-2016-6811High
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
- CVE-2016-5393High
In Apache Hadoop versions 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
Original NVD description (English source)
Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.