CVE-2015-1836: Apache HBase remote denial of service, information
integrity, and information disclosure vulnerability.
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
HBase 0.98.0 - 0.98.12
HBase 1.0.0 - 1.0.1
HBase 1.1.0
The unsupported HBase 0.96 versions are also affected.
Description:
A logic error caused HBase in most secure configuration deployments to
handle its coordination state in ZooKeeper via insecure ACLs. Anyone with
remote unauthenticated network access to the ZooKeeper quorum, which by
definition includes all HBase clients, can make use of this opening to
degrade or completely stop availability. Any user with the authentication
credentials needed to connect to the HBase cluster as a normal user can, in
some configurations, read newly written HBase data that they are not
authorized to see. We believe it is possible for any user with
authentication credentials for the underlying HDFS cluster to write
arbitrary HBase data. Work to confirm this last attack vector is ongoing
and this announcement will be updated when we have more information.
Mitigation:
HBase users should update to the latest hotfix release of their respective
version (e.g. 0.98.12.1, 1.0.1.1, 1.1.0.1) to ensure newly written
coordination information has the correct ACLs. Any of these hotfix upgrades
can be done via a zero downtime rolling upgrade[1]. Because this logic bug
can mask some configuration errors, users are encouraged to verify their
deployments prior to starting the upgrade process[2].
Once on an appropriate version, users *must* run through the following
sequence of ZooKeeper commands via the ZooKeeper cli as the hbase service
account. For more information on using the ZooKeeper cli in a secure set
up, refer to the ZooKeeper documentation[3].
setAcl /hbase world:anyone:r,sasl:hbase:cdrwa
setAcl /hbase/backup-masters sasl:hbase:cdrwa
setAcl /hbase/draining sasl:hbase:cdrwa
setAcl /hbase/flush-table-proc sasl:hbase:cdrwa
setAcl /hbase/hbaseid world:anyone:r,sasl:hbase:cdrwa
setAcl /hbase/master world:anyone:r,sasl:hbase:cdrwa
setAcl /hbase/meta-region-server world:anyone:r,sasl:hbase:cdrwa
setAcl /hbase/namespace sasl:hbase:cdrwa
setAcl /hbase/online-snapshot sasl:hbase:cdrwa
setAcl /hbase/region-in-transition sasl:hbase:cdrwa
setAcl /hbase/recovering-regions sasl:hbase:cdrwa
setAcl /hbase/replication sasl:hbase:cdrwa
setAcl /hbase/rs sasl:hbase:cdrwa
setAcl /hbase/running sasl:hbase:cdrwa
setAcl /hbase/splitWAL sasl:hbase:cdrwa
setAcl /hbase/table sasl:hbase:cdrwa
setAcl /hbase/table-lock sasl:hbase:cdrwa
setAcl /hbase/tokenauth sasl:hbase:cdrwa
Credit:
This issue was discovered by Paul Codding and Enis Söztutar.
References:
1: http://hbase.apache.org/book.html#hbase.rolling.upgrade
2: http://hbase.apache.org/book.html#_external_zookeeper_configuration
3: http://s.apache.org/Rgo
