Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4789-1 advisory.

    It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use     this issue to cause a denial of service or other unspecified impact. (CVE-2016-5017)

    It was discovered that Apache ZooKeeper incorrectly implemented wchp/wchc commands. An attacker could     possibly use this issue to cause a denial of service. (CVE-2017-5637)

    It was discovered that Apache Zookeeper incorrectly handled clusters. An attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache ZooKeeper listening on the remote host is prior to 3.4.10 or 3.5.x prior to 3.5.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the C cli shell. Using     the 'cmd:' batch mode syntax allows attackers to have an     unspecified impact via a long command string.     (CVE-2016-5017)

  - A denial of service (DoS) vulnerability exists in due to two     four letter word commands which cause CPU spikes on ZooKeeper     server. An unauthenticated, remote attacker can exploit this     issue to cause the application to stop responding.     (CVE-2017-5637)

zookeeper developers report :

Two four letter word commands 'wchp/wchc' are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.
Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption.

This update disables those two commands by default. The new configuration option '4lw.commands.whitelist' can be used to whitelist commands selectively (and the full set of commands can be restored with '*')

For Debian 7 'Wheezy', these problems have been fixed in version 3.4.5+dfsg-2+deb7u1.

We recommend that you upgrade your zookeeper packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption.

This update disables those two commands by default. The new configuration option '4lw.commands.whitelist' can be used to whitelist commands selectively (and the full set of commands can be restored with '*')

ID	Name	Product	Family	Severity
183528	Ubuntu 16.04 ESM : Apache ZooKeeper vulnerabilities (USN-4789-1)	Nessus	Ubuntu Local Security Checks	high
125634	Apache ZooKeeper 3.4.0 < 3.4.10 / 3.5.x < 3.5.3 Multiple Vulnerabilities	Nessus	Misc.	high
103762	FreeBSD : zookeeper -- Denial Of Service (af61b271-9e47-4db0-a0f6-29fb032236a3)	Nessus	FreeBSD Local Security Checks	high
100816	Debian DLA-986-1 : zookeeper security update	Nessus	Debian Local Security Checks	high
100579	Debian DSA-3871-1 : zookeeper - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-5637

high

Tenable Plugins

high

high

high

high

high