Lucene search

DellCVE-2016-6656

HistoryDec 16, 2016 - 9:59 a.m.

CVE-2016-6656

2016-12-1609:59:00

CWE-77

dell

web.nvd.nist.gov

cve-2016-6656

pivotal greenplum

command injection

gphdfs protocol

vulnerability

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser ‘gpadmin’ access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table.

Affected configurations

Nvd

Node

pivotal_softwaregreenplumRange≤4.3.9.1

VendorProductVersionCPE
pivotal_softwaregreenplum*cpe:2.3:a:pivotal_software:greenplum:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pivotal_software	greenplum	*	cpe:2.3:a:pivotal_software:greenplum::::::::

CNA Affected

[
  {
    "product": "Pivotal Greenplum 4.3.0.0 to 4.3.9.1 and older versions that are end of life",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Pivotal Greenplum 4.3.0.0 to 4.3.9.1 and older versions that are end of life"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94954

pivotal.io/security/cve-2016-6656

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

Related for CVE-2016-6656