CVE:CVE-2014-3627
CNNVD:CNNVD-201412-083
Apache Hadoop是美国阿帕奇（Apache）软件基金会的一套开源的分布式系统基础架构，它能够对大量数据进行分布式处理，并具有高可靠性、高扩展性、高容错性等特点。
Apache Hadoop 0.23.0版本至0.23.11版本和2.5.2之前2.x版本中的YARN NodeManager守护进程中存在安全漏洞。远程攻击者可通过对tar归档实施符号链接攻击利用该漏洞更改特定文件的权限为全局可读。
solution:Upgrade apache hadoop to a higher version than 0.23.0,0.23.1,0.23.3,0.23.4,0.23.5,0.23.6,0.23.7,0.23.8,0.23.9,0.23.10,0.23.11,2.0.0:alpha,2.0.1:alpha,2.0.2:alpha,2.0.3:alpha,2.0.4:alpha,2.0.5:alpha,2.0.6:alpha,2.1.0:beta,2.1.1:beta,2.2.0,2.3.0,2.4.0,2.4.1,2.5.0,2.5.1,and avoid the version 0.23.0,0.23.1,0.23.3,0.23.4,0.23.5,0.23.6,0.23.7,0.23.8,0.23.9,0.23.10,0.23.11,2.0.0:alpha,2.0.1:alpha,2.0.2:alpha,2.0.3:alpha,2.0.4:alpha,2.0.5:alpha,2.0.6:alpha,2.1.0:beta,2.1.1:beta,2.2.0,2.3.0,2.4.0,2.4.1,2.5.0,2.5.1