CVE-2014-3627
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar…
Does this matter?
Lower severity and a low EPSS score (3.00%). Track it; it rarely justifies an emergency change on its own.
Description
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.00% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-59
- Affected
- apache/hadoop
- Source
- secalert@redhat.com
References
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E
- http://secunia.com/advisories/60079
- http://secunia.com/advisories/60432
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E
- http://secunia.com/advisories/60079
- http://secunia.com/advisories/60432
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.