Multiple Flaws Uncovered in ClickHouse OLAP Database System for Big Data
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-43304 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy (op, ip, copy_end), don’t exceed the destination buffer’s limits. NVD description · AI analysis pending | 8.8 group max | 2% | PoC |
| — | |
| CVE-2021-44521 | When running Apache Cassandra with the following configuration: When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE. NVD description · AI analysis pending | 9.1 | 55% | PoC |
| — |
Full article325 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 16, 2022
Researchers have disclosed seven new security vulnerabilities in an open-source database management system solution called ClickHouse that could be weaponized to crash the servers, leak memory contents, and even lead to the execution of arbitrary code.
"The vulnerabilities require authentication, but can be triggered by any user with read permissions," Uriya Yavnieli and Or Peles, researchers from DevSecOps firm JFrog, said in a report published Tuesday.
"This means the attacker must perform reconnaissance on the specific ClickHouse server target to obtain valid credentials. Any set of credentials would do, since even a user with the lowest privileges can trigger all of the vulnerabilities."
The list of seven flaws is below –
- CVE-2021-43304 and CVE-2021-43305 (CVSS scores: 8.8) – Heap buffer overflow flaws in the LZ4 compression codec that could lead to remote code execution
- CVE-2021-42387 and CVE-2021-42388 (CVSS scores: 7.1) – Heap out-of-bounds read flaws in the LZ4 compression codec that could lead to denial-of-service or information leakage
- CVE-2021-42389 (CVSS score: 6.5) – A divide-by-zero flaw in the Delta compression codec that could result in a denial-of-service condition
- CVE-2021-42390 (CVSS score: 6.5) – A divide-by-zero flaw in the DeltaDouble compression codec that could result in a denial-of-service condition
- CVE-2021-42391 (CVSS score: 6.5) – A divide-by-zero flaw in the Gorilla compression codec that could result in a denial-of-service condition
An attacker can take advantage of any of the aforementioned flaws by using a specially crafted compressed file to crash a vulnerable database server. ClickHouse users are recommended to upgrade to version "v21.10.2.15-stable" or later to mitigate the issues.
The findings come a month after JFrog disclosed details of a high-severity security vulnerability in Apache Cassandra (CVE-2021-44521, CVSS score: 8.4) that, if left unaddressed, could be abused to gain remote code execution (RCE) on affected installations.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/03/multiple-flaws-uncovered-in-clickhouse.html