Incorrect default permissions in Hadoop - CVE-2024-23454

Vulnerability identifier: #VU97712

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-23454

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the RunJar.run() method does not set permissions for temporary directory by default. A local user with access to the system can view contents of files and directories.

Hadoop
Log Analysis
Netcool Operations Insight
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Cloud Application Performance Management (APM)
watsonx.data
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
IBM QRadar Incident Forensics
openEuler
hadoop-3.1-yarn
hadoop-3.1-debugsource
hadoop-3.1-tests
hadoop-3.1-maven-plugin
hadoop-3.1-mapreduce-examples
hadoop-3.1-mapreduce
hadoop-3.1-httpfs
hadoop-3.1-hdfs
hadoop-3.1-common
hadoop-3.1-client
libhdfs
hadoop-3.1-yarn-security
hadoop-3.1-devel
hadoop-3.1
hadoop-3.1-common-native
hadoop-3.1-debuginfo
hadoop-yarn-security
hadoop-yarn
hadoop-tests
hadoop-maven-plugin
hadoop-mapreduce-examples
hadoop-mapreduce
hadoop-httpfs
hadoop-hdfs
hadoop-common
hadoop-client
hadoop-devel
hadoop-debugsource
hadoop-debuginfo
hadoop-common-native
hadoop
IBM Qradar SIEM
IBM DB2

Install updates from vendor's website.

Hadoop - update to 3.4.0
Log Analysis - update to 1.3.8.2
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
hadoop-3.1-yarn - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-debugsource - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-tests - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-maven-plugin - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-mapreduce-examples - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-mapreduce - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-httpfs - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-hdfs - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-common - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-client - addressed in versions 3.1.4-5, 3.1.4-11
libhdfs - addressed in versions 3.1.4-5, 3.1.4-11, 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-3.1-yarn-security - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-devel - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1 - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-common-native - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-3.1-debuginfo - addressed in versions 3.1.4-5, 3.1.4-11
hadoop-yarn-security - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-yarn - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-tests - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-maven-plugin - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-mapreduce-examples - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-mapreduce - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-httpfs - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-hdfs - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-common - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-client - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-devel - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-debugsource - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-debuginfo - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop-common-native - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
hadoop - addressed in versions 3.3.4-4, 3.3.6-3, 3.3.6-4
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
IBM DB2 - addressed in versions 11.1.4 FP7, 11.5.9, 12.1.1

• https://issues.apache.org/jira/browse/HADOOP-19031
• https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs

• Information disclosure in Apache Hadoop
• openEuler 22.03 LTS SP4 update for hadoop
• openEuler 24.03 LTS update for hadoop
• openEuler 22.03 LTS SP3 update for hadoop
• openEuler 22.03 LTS SP1 update for hadoop-3.1
• openEuler 20.03 LTS SP4 update for hadoop-3.1
• Multiple vulnerabilities in IBM QRadar SIEM
• openEuler 22.03 LTS SP1 update for hadoop
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• IBM Db2 update for Apache Hadoop
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products
• Multiple vulnerabilities in IBM OpenPages
• IBM watsonx.data update for Apache Hadoop
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data