Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on
    Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.
    Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
    (CVE-2017-5637)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Services     (jackson-databind)). Supported versions that are affected are 21.5 and Prior. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core -     Server Framework. Successful attacks of this vulnerability can result in takeover of Siebel Core - Server     Framework. (CVE-2020-24750)

  - Vulnerability in the Siebel Core - Automation product of Oracle Siebel CRM (component: Test Automation     (Eclipse Jetty)). Supported versions that are affected are 21.5 and Prior. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Core -     Automation executes to compromise Siebel Core - Automation. Successful attacks of this vulnerability can     result in takeover of Siebel Core - Automation. (CVE-2020-27216)

  - Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Cloud Gateway     (Zookeeper)). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - Server Framework.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel Core - Server Framework. (CVE-2017-5637)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing     Stand-Alone). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel     Apps - Marketing accessible data. (CVE-2021-2338)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server     Infrastructure). Supported versions that are affected are 21.5 and Prior. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Siebel CRM accessible data. (CVE-2021-2368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4789-1 advisory.

    It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use     this issue to cause a denial of service or other unspecified impact. (CVE-2016-5017)

    It was discovered that Apache ZooKeeper incorrectly implemented wchp/wchc commands. An attacker could     possibly use this issue to cause a denial of service. (CVE-2017-5637)

    It was discovered that Apache Zookeeper incorrectly handled clusters. An attacker could possibly use this     issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache ZooKeeper listening on the remote host is prior to 3.4.10 or 3.5.x prior to 3.5.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the C cli shell. Using     the 'cmd:' batch mode syntax allows attackers to have an     unspecified impact via a long command string.     (CVE-2016-5017)

  - A denial of service (DoS) vulnerability exists in due to two     four letter word commands which cause CPU spikes on ZooKeeper     server. An unauthenticated, remote attacker can exploit this     issue to cause the application to stop responding.     (CVE-2017-5637)

zookeeper developers report :

Two four letter word commands 'wchp/wchc' are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.
Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption.

This update disables those two commands by default. The new configuration option '4lw.commands.whitelist' can be used to whitelist commands selectively (and the full set of commands can be restored with '*')

For Debian 7 'Wheezy', these problems have been fixed in version 3.4.5+dfsg-2+deb7u1.

We recommend that you upgrade your zookeeper packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption.

This update disables those two commands by default. The new configuration option '4lw.commands.whitelist' can be used to whitelist commands selectively (and the full set of commands can be restored with '*')

ID	Name	Product	Family	Severity
412007	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-7cwj-j333-x7f7)	Tenable Cloud Security	SCA Checks	high
412007	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-7cwj-j333-x7f7)	Tenable Self-Hosted Container Security	SCA Checks	high
212428	Oracle Siebel Server (July 2021 CPU)	Nessus	Misc.	high
183528	Ubuntu 16.04 ESM : Apache ZooKeeper vulnerabilities (USN-4789-1)	Nessus	Ubuntu Local Security Checks	high
125634	Apache ZooKeeper 3.4.0 < 3.4.10 / 3.5.x < 3.5.3 Multiple Vulnerabilities	Nessus	Misc.	high
103762	FreeBSD : zookeeper -- Denial Of Service (af61b271-9e47-4db0-a0f6-29fb032236a3)	Nessus	FreeBSD Local Security Checks	high
100816	Debian DLA-986-1 : zookeeper security update	Nessus	Debian Local Security Checks	high
100579	Debian DSA-3871-1 : zookeeper - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-5637

high

Tenable Plugins

high

high

high

high

high

high

high

high