It was reported [1] that:
"The Apache Hadoop RPC protocol is intended to provide bidirectional
authentication between clients and servers. However, a malicious server or
network attacker can unilaterally disable these authentication checks. This
allows for potential reduction in the configured quality of protection of
the RPC traffic, and privilege escalation if authentication credentials are
passed over RPC."
This flaw only affects users who have enabled Hadoop's kerberos security features. This is corrected in upstream versions 0.23.9, 1.2.1, and 2.0.6-alpha.
[1] http://seclists.org/fulldisclosure/2013/Aug/251