CVE-2015-2263: Low severity cloudera manager vulnerability
Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2263?
The severity of CVE-2015-2263 is considered moderate due to the potential unauthorized access to sensitive configuration files.
How do I fix CVE-2015-2263?
To fix CVE-2015-2263, update Cloudera Manager to version 5.0.6 or later, or an equivalent patched version.
Who is affected by CVE-2015-2263?
CVE-2015-2263 affects Cloudera Manager versions 4.x and 5.0.x through 5.3.2.
What is the exploit for CVE-2015-2263?
The exploit for CVE-2015-2263 involves local users gaining read access to sensitive files in the configuration directory when YARN NodeManager starts.
What should I do if I cannot upgrade to fix CVE-2015-2263?
If you cannot upgrade, consider implementing stricter file permissions for the configuration directory to mitigate risks associated with CVE-2015-2263.