PT-2017-4254 · Apache · Apache Hadoop
Publicado
2017-11-13
·
Atualizado
2020-08-24
·
CVE-2017-3166
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Hadoop versions 2.6.1 through 2.6.5
Apache Hadoop versions 2.7.0 through 2.7.3
Apache Hadoop version 3.0.0-alpha1
Description
The issue is related to incorrect file permission assignments in Apache Hadoop. This can allow a remote attacker to bypass file access restrictions. If a file in an encryption zone with world-readable access permissions is localized via YARN's localization mechanism, it will be stored in a world-readable location and can be shared with any application that requests to localize that file.
Recommendations
For Apache Hadoop versions 2.6.1 through 2.6.5, consider restricting access to files in encryption zones to prevent them from being stored in world-readable locations.
For Apache Hadoop versions 2.7.0 through 2.7.3, restrict access to files in encryption zones to prevent them from being stored in world-readable locations.
For Apache Hadoop version 3.0.0-alpha1, restrict access to files in encryption zones to prevent them from being stored in world-readable locations.
Correção
Incorrect Permission
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Hadoop