File Permission Manipulation Via Symlink Attack

2018-03-2202:07:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

44.3%

JSON

hadoop-common-yarn is vulnerable to file permission manipulation. Using a symlink attack in a public tar archive, attackers can change the permissions on files to be world-readable.

CPENameOperatorVersion
apache hadoop yarn commonle0.23.11
apache hadoop yarn commonle2.5.1
apache hadoop yarn nodemanagerle2.5.1

Name	Operator	Version
apache hadoop yarn common	le	0.23.11
apache hadoop yarn common	le	2.5.1
apache hadoop yarn nodemanager	le	2.5.1

References

mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug@mail.gmail.com%3E

secunia.com/advisories/60079

secunia.com/advisories/60432

github.com/apache/hadoop/commit/745c9a01243b8eefc72d89d1164d7d010b80983b#diff-6a045596433c8c241fcb7b1c6d5dd952

0.001 Low

EPSS

Percentile

44.3%

JSON

Related for VERACODE:6005