PT-2014-5427 · Apache · Apache Hadoop

Publicado 2014-12-05 · Atualizado 2022-05-17 · CVE-2014-3627

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 0.23.0 through 0.23.11 Apache Hadoop versions 2.x before 2.5.2

Description The issue allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive. This occurs when using Kerberos authentication and is related to the distributed cache, specifically due to improper handling during localization.

Recommendations For Apache Hadoop versions 0.23.0 through 0.23.11, update to a version outside of this range to resolve the issue. For Apache Hadoop versions 2.x before 2.5.2, update to version 2.5.2 or later to resolve the issue.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2014-3627

GHSA-JPMF-8CJ2-595G

Produtos afetados

Apache Hadoop

Referências · 6

• http://secunia.com/advisories/60432 · Nota
• https://osv.dev/vulnerability/GHSA-jpmf-8cj2-595g · Aviso do Fabricante
• http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/[e-mail]%3E · Nota
• http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E · Nota
• http://secunia.com/advisories/60079 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3627 · Nota de Segurança