CVE-2014-3627: Medium severity apache hadoop vulnerability

Published Dec 5, 2014

Updated

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

Affected Software

26 affected components

Apache Hadoop=0.23.0

Apache Hadoop=0.23.1

Apache Hadoop=0.23.3

Apache Hadoop=0.23.4

Apache Hadoop=0.23.5

Apache Hadoop=0.23.6

Apache Hadoop=0.23.7

Apache Hadoop=0.23.8

Apache Hadoop=0.23.9

Apache Hadoop=0.23.10

Apache Hadoop=0.23.11

Apache Hadoop=2.0.0-alpha

Apache Hadoop=2.0.1-alpha

Apache Hadoop=2.0.2-alpha

Apache Hadoop=2.0.3-alpha

Apache Hadoop=2.0.4-alpha

Apache Hadoop=2.0.5-alpha

Apache Hadoop=2.0.6-alpha

Apache Hadoop=2.1.0-beta

Apache Hadoop=2.1.1-beta

Apache Hadoop=2.2.0

Apache Hadoop=2.3.0

Apache Hadoop=2.4.0

Apache Hadoop=2.4.1

Apache Hadoop=2.5.0

Apache Hadoop=2.5.1

Event History

Dec 5, 2014

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3627?

CVE-2014-3627 has a CVSS score of 6.5, indicating a medium severity vulnerability.

How do I fix CVE-2014-3627?

To remediate CVE-2014-3627, upgrade Apache Hadoop to version 2.5.2 or later, or apply the relevant patches if available.

What versions of Apache Hadoop are affected by CVE-2014-3627?

CVE-2014-3627 affects Apache Hadoop versions 0.23.0 through 0.23.11 and 2.x before 2.5.2.

What type of attack does CVE-2014-3627 involve?

CVE-2014-3627 involves a symlink attack that allows remote cluster users to change file permissions.

Is CVE-2014-3627 related to Kerberos authentication?

Yes, CVE-2014-3627 specifically affects the YARN NodeManager daemon when using Kerberos authentication.