Apache Hadoop Parameter Injection Vulnerability

Apache Hadoop is an open source distributed system infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. Apache Hadoop has a security vulnerability that stems from its FileUtil.unTar(File, File) API that does not escape the name of the file submitted by the user to the shell causing an attacker to inject arbitrary commands. No details of the vulnerability are currently available.