CVE-2014-3627 | BDVDB-2026-66528 Detail

Description#

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E
http://secunia.com/advisories/60079
http://secunia.com/advisories/60432

Exploit#

No public exploit known

History#

Version 12014-12-05Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.