CVE-2024-29869

What it actually does

Creates a credentials file in a temporary directory with default 644 permissions when not explicitly set, exposing sensitive credential contents to any local user with directory access.

Why it matters to the business

Exposure of credentials in multi-user or shared environments can lead to unauthorized access to databases or services, increasing breach risk and compliance issues; the issue affects widely used Hive deployments across many organizations.

How an attack unfolds

An attacker with local access to the temporary directory used by Hive locates the newly created credentials file and reads its contents to obtain sensitive authentication material for further attacks.

How to fix it

Upgrade apache/hive to the fixed versions 20106e254527f7d71b2e34455c4322e14950c620 or 3af4517eb8cfd9407ad34ed78a0b48b57dfaa264 (equivalent to 4.0.1); update affected Red Hat Thunderbird packages to 0:91.3.0-2.el7_9 or later; set explicit restrictive permissions on any credentials files.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases, inspect newly created credentials files for permissions stricter than 644, and test credential file creation under explicit permission settings.

Typical attack path

1. Obtain local filesystem access to the temporary directory used by the application
2. Identify the credentials file created with 644 permissions
3. Read the file to extract embedded credentials
4. Use harvested credentials for lateral movement or data access

How to detect it

Examine temporary directories for files matching credentials patterns created with 644 permissions, review local file access logs for unexpected reads of those files, and correlate with Hive process activity.

• credentials file mode 644
• /tmp/.*credentials
• hive credentials exposure in temp dir

What your security team should do

• Apply the listed fixed versions immediately due to credential exposure risk
• Enforce explicit file permission settings in Hive configuration
• Audit temporary directories for world-readable credential artifacts
• Review local access controls on systems running affected Hive versions