CVE-2016-6656

Published: Dec 16, 2016Modified: May 6, 2026

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table.

Affected (1)

Products: Pivotal Software: Greenplum

Pivotal Software

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Greenplum	Up to 4.3.9.1

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

http://www.securityfocus.com/bid/94954

Source: security_alert@emc.com

https://pivotal.io/security/cve-2016-6656

Source: security_alert@emc.com

MitigationVendor Advisory

http://www.securityfocus.com/bid/94954

Source: af854a3a-2127-422b-91ae-364da2661108

https://pivotal.io/security/cve-2016-6656

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.