No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4789-1 advisory.

    It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use     this issue to cause a denial of service or other unspecified impact. (CVE-2016-5017)

    It was discovered that Apache ZooKeeper incorrectly implemented wchp/wchc commands. An attacker could     possibly use this issue to cause a denial of service. (CVE-2017-5637)

    It was discovered that Apache Zookeeper incorrectly handled clusters. An attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Zookeeper, a service for maintaining configuration information, enforced no authentication/authorisation when a server attempts to join a Zookeeper quorum.

This update backports authentication support. Additional configuration steps are needed, please see https://cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mu tual+authenticationfor additional information.

The instance of Apache Zookeeper listening on the remote host is either running a version that does not support quorum authentication or has not been configured to use quorum authentication. This may allow a remote attacker to join a cluster quorum and begin propagating counterfeit changes to the leader.

ID	Name	Product	Family	Severity
183528	Ubuntu 16.04 ESM : Apache ZooKeeper vulnerabilities (USN-4789-1)	Nessus	Ubuntu Local Security Checks	high
110315	Debian DSA-4214-1 : zookeeper - security update	Nessus	Debian Local Security Checks	high
110266	Apache Zookeeper x < 3.4.10 / 3.5.x < 3.5.4 Missing Authentication Remote Quorum Joining Vulnerability	Nessus	Misc.	high

Detections

Analytics

CVE-2018-8012

high

Tenable Plugins

high

high

high