CVE-2014-3627: Improper Link Resolution Before File Access in Apache Hadoop
Summary
CVE-2014-3627: Improper Link Resolution Before File Access in Apache Hadoop. Affects org.apache.hadoop:hadoop-client across 2 version ranges.
>= 0.23.0, < 1.0.1
>= 2.0.0, < 2.5.2
Fixed in 1.0.1 or 2.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The Hadoop ecosystem includes various components, such as the YARN NodeManager daemon, which is responsible for managing resources and executing tasks on individual nodes in a Hadoop cluster. This vulnerability affects versions 0.23.0 through 0.23.11 and 2.x before 2.5.2 of the Apache Hadoop client package.
Vulnerability Detail
The YARN NodeManager daemon in Apache Hadoop, when using Kerberos authentication, is susceptible to an improper link resolution vulnerability. This vulnerability allows remote cluster users to change the permissions of certain files to world-readable. The attack is carried out through a symlink attack in a public tar archive, which is not properly handled during localization and distributed cache. This can lead to unauthorized access to sensitive information and potential data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.23.0, < 1.0.11.0.1 -
>= 2.0.0, < 2.5.22.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to a fixed version of the Apache Hadoop client package.
Conclusion
The vulnerability in Apache Hadoop's YARN NodeManager daemon can result in unauthorized access to sensitive files. It is crucial to upgrade to a fixed version of the Apache Hadoop client package and implement proper security measures to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-client →
FAQ
Apache Hadoop is an open-source framework for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
The YARN NodeManager daemon is a component of Apache Hadoop that manages resources and executes tasks on individual nodes in a Hadoop cluster.
Kerberos authentication is a network authentication protocol that uses tickets to verify the identities of users and services in a distributed network environment.
A symlink attack, also known as a symbolic link attack, is a security vulnerability that exploits the use of symbolic links to gain unauthorized access to files or directories.
This vulnerability can allow remote cluster users to change the permissions of certain files to world-readable, leading to unauthorized access to sensitive information and potential data breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-client.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.