CVE-2017-5640
CriticalSummary
In Apache Impala versions 2.7.0 to 2.8.0, a vulnerability was identified that allows a malicious process to impersonate an Impala daemon. This can lead to skipping authentication checks when Kerberos is enabled but TLS is not used.
Risk Assessment
This threat could allow attackers to gain access to the system without proper authorization, potentially leading to data leaks or unauthorized access to resources.
Recommendation
It is recommended to update Apache Impala to the latest version that includes security fixes and to enable TLS to secure communication.
Original NVD description (English source)
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not). If the malicious server responds with 'COMPLETE' before the SASL handshake has completed, the client will consider the handshake as completed even though no exchange of credentials has happened.