Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

Hadoop 1.0.3 contains a symlink vulnerability as a result of storing pid files in the shared /tmp directory by default.

It was reported [1] that:

"The Apache Hadoop RPC protocol is intended to provide bidirectional authentication between clients and servers. However, a malicious server or network attacker can unilaterally disable these authentication checks. This allows for potential reduction in the configured quality of protection of the RPC traffic, and privilege escalation if authentication credentials are passed over RPC."

This flaw only affects users who have enabled Hadoop's kerberos security features. This is corrected in upstream versions 0.23.9, 1.2.1, and 2.0.6-alpha.

[1] http://seclists.org/fulldisclosure/2013/Aug/251