Security Bulletin: Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials (CVE-2015-1772, CVE-2015-1836).

Vulnerability Details

CVEID: CVE-2015-1772
DESCRIPTION: Apache Hive could allow a remote attacker to bypass security restrictions, caused by an error in the HiveServer2 interface. If HiveServer2 is configured to use LDAP authentication mode and the configuration permits simple unauthenticated or anonymous binds, an attacker could exploit this vulnerability to authenticate with improper credentials.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com//vulnerabilities/103333 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-1836
DESCRIPTION: Apache HBase could allow a remote attacker to gain unauthorized access to the system, caused by a logic error that allows the handling of ZooKeeper via insecure ACLs. An attacker with access to the ZooKeeper quorum could exploit this vulnerability to read or write HBase data or completely stop availability.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com//vulnerabilities/103332 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)