Apache Ranger CVE-2017-7677 Security Bypass Vulnerability

Bugtraq ID:	98961
Class:	Design Error
CVE:	CVE-2017-7677
Remote:	Yes
Local:	No
Published:	Jun 07 2017 12:00AM
Updated:	Jun 07 2017 12:00AM
Credit:	Velmurugan Periasamy
Vulnerable:	Apache Ranger 0.7 Apache Ranger 0.6.3 Apache Ranger 0.6.1 Apache Ranger 0.5.2 Apache Ranger 0.5 Apache Ranger 0.6.2 Apache Ranger 0.6.0 Apache Ranger 0.5.3 Apache Ranger 0.5.1
Not Vulnerable:	Apache Ranger 0.7.1

Apache Ranger CVE-2017-7677 Security Bypass Vulnerability

Apache Ranger is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks.

Apache Ranger version 0.5.x, 0.6.x, and 0.7.0 are vulnerable.

Apache Ranger CVE-2017-7677 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Ranger CVE-2017-7677 Security Bypass Vulnerability

References:

• CVE update - fixed in Apache Ranger 0.7.1 (Seclists.org)
  
• Apache Ranger Homepage (Apache)
  
• 0.7.1 Release - Apache Ranger (apache)