Unscored severity · published Jul 12, 2012
CVE-2012-3376
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a…
–
CVSS
2.6%
EPSS
No
On KEV
Description
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hadoop · Apache
2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3376
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3376
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-07/0049.html
www.securityfocus.com
http://www.securityfocus.com/bid/54358
www.cloudera.com
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
More from Hadoop
9.8
CVE-2022-25168
Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
9.8
CVE-2021-37404
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code
9.8
CVE-2022-26612
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes
9.8
CVE-2019-17195
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or…
9.8
CVE-2017-15718
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications