mapr Information Disclosure

`Hello,  
  
The mapr web frontend component creates an information disclosure  
vulnerability. During the setup of mapr the configure.sh script calls a  
function ConfigureWSRole:  
  
function ConfigureWSRole() {  
if [ $clientOnly -eq 0 -a $dontChangeSecurityPermissionsOn -eq 0 ];  
then  
ConfigureRunUserForWS  
fi  
  
This calls ConfigureRunUserForWS from configure-common.sh:  
  
function ConfigureRunUserForWS() {  
local val=`getent group shadow 2>/dev/null`  
if [ "$?" != "0" -o "$val" = "" ]; then  
# Create a group named shadow  
groupadd shadow >> $logFile 2>&1  
fi  
# Add CURR_USER to the group wheel  
if [ -f /etc/SuSE-release ]; then  
# Add CURR_USER to the group wheel for SUSE  
usermod -A shadow $MAPR_USER >> $logFile 2>&1  
STATUS=$?  
#  
# The '-A' option has been removed from SuSE 12   
#  
if [ $STATUS -ne 0 ]; then  
usermod -a -G shadow $MAPR_USER >> $logFile 2>&1  
fi  
else  
usermod -a -G $MAPR_GROUP,shadow $MAPR_USER >> $logFile 2>&1  
fi  
# Change group-owner of /etc/shadow  
chgrp shadow /etc/shadow >> $logFile 2>&1  
# Allow read permissions for user shadow  
chmod ug+r /etc/shadow >> $logFile 2>&1  
}  
  
This results in a shadow file that is now readable to the application:  
  
# ls -la /etc/shadow  
-r--r-----. 1 root shadow 657 Mar 30 16:09 /etc/shadow  
# grep shadow /etc/group  
shadow:x:1000:mapr  
  
The option to disable this codepath, -no-auto-permission-update, is not  
recommended by Mapr and comes with a warning in the script as it will  
break the webserver's ability to authenticate the local mapr user, which  
is used to administer the cluster:  
  
echo " -no-auto-permission-update - do not update the system  
security permissions automatically"  
echo " Warn: Features like WebServer  
might not work properly"  
echo " default: disabled"  
  
The website docs[1] casually describe the option, "Pass this option to  
prevent MapR from silently altering permissions in /etc/shadow."  
  
These files are part of the mapr-core-internal package:  
  
# rpm -fq /opt/mapr/server/configure.sh  
mapr-core-internal-5.2.0.39122.GA-1.x86_64  
# rpm -fq /opt/mapr/server/configure-common.sh  
mapr-core-internal-5.2.0.39122.GA-1.x86_64  
  
  
Thanks  
  
[1] http://maprdocs.mapr.com/home/ReferenceGuide/configure.sh.html  
  
--   
Mark Felder  
[email protected]  
  
  
`