5

CVE-2014-3627

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Hadoop Version0.23.0
Apache ≫ Hadoop Version0.23.1
Apache ≫ Hadoop Version0.23.3
Apache ≫ Hadoop Version0.23.4
Apache ≫ Hadoop Version0.23.5
Apache ≫ Hadoop Version0.23.6
Apache ≫ Hadoop Version0.23.7
Apache ≫ Hadoop Version0.23.8
Apache ≫ Hadoop Version0.23.9
Apache ≫ Hadoop Version0.23.10
Apache ≫ Hadoop Version0.23.11
Apache ≫ Hadoop Version2.0.0 Updatealpha
Apache ≫ Hadoop Version2.0.1 Updatealpha
Apache ≫ Hadoop Version2.0.2 Updatealpha
Apache ≫ Hadoop Version2.0.3 Updatealpha
Apache ≫ Hadoop Version2.0.4 Updatealpha
Apache ≫ Hadoop Version2.0.5 Updatealpha
Apache ≫ Hadoop Version2.0.6 Updatealpha
Apache ≫ Hadoop Version2.1.0 Updatebeta
Apache ≫ Hadoop Version2.1.1 Updatebeta
Apache ≫ Hadoop Version2.2.0
Apache ≫ Hadoop Version2.3.0
Apache ≫ Hadoop Version2.4.0
Apache ≫ Hadoop Version2.4.1
Apache ≫ Hadoop Version2.5.0
Apache ≫ Hadoop Version2.5.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.62% 0.812
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.