Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.

An update of the zookeeper package has been released.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4789-1 advisory.

    It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use     this issue to cause a denial of service or other unspecified impact. (CVE-2016-5017)

    It was discovered that Apache ZooKeeper incorrectly implemented wchp/wchc commands. An attacker could     possibly use this issue to cause a denial of service. (CVE-2017-5637)

    It was discovered that Apache Zookeeper incorrectly handled clusters. An attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache ZooKeeper listening on the remote host is prior to 3.4.10 or 3.5.x prior to 3.5.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the C cli shell. Using     the 'cmd:' batch mode syntax allows attackers to have an     unspecified impact via a long command string.     (CVE-2016-5017)

  - A denial of service (DoS) vulnerability exists in due to two     four letter word commands which cause CPU spikes on ZooKeeper     server. An unauthenticated, remote attacker can exploit this     issue to cause the application to stop responding.     (CVE-2017-5637)

Security fix for CVE-2016-5017 (update to 3.4.9)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Lyon Yang discovered that the C client shells cli_st and cli_mt of Apache Zookeeper, a high-performance coordination service for distributed applications, were affected by a buffer overflow vulnerability associated with parsing of the input command when using the 'cmd:' batch mode syntax. If the command string exceeds 1024 characters a buffer overflow will occur.

For Debian 7 'Wheezy', these problems have been fixed in version 3.3.5+dfsg1-2+deb7u1.

We recommend that you upgrade your zookeeper packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203065	Photon OS 1.0: Zookeeper PHSA-2016-0012	Nessus	PhotonOS Local Security Checks	high
183528	Ubuntu 16.04 ESM : Apache ZooKeeper vulnerabilities (USN-4789-1)	Nessus	Ubuntu Local Security Checks	high
125634	Apache ZooKeeper 3.4.0 < 3.4.10 / 3.5.x < 3.5.3 Multiple Vulnerabilities	Nessus	Misc.	high
96204	Fedora 25 : zookeeper (2016-5557ccf1f9)	Nessus	Fedora Local Security Checks	high
96203	Fedora 24 : zookeeper (2016-54a717d5d6)	Nessus	Fedora Local Security Checks	high
93570	Debian DLA-630-1 : zookeeper security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-5017

high

Tenable Plugins

high

high

high

high

high

high