CVE-2011-2729

Apache Tomcat 5.5.32-5.5.33, 6.0.30-6.0.32, 7.0.x < 7.0.20 - Unauthenticated File Read via jsvc Capabilities Bypass

Title source: llm
STIX 2.1

Description

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

References (30)

Core 30
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69161
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=136485229118404&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1025925
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-7.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133469267822771&w=2
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=730400
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1291.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=132215163318824&w=2
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/519263/100/0/threaded
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-6.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57126
Various Sources x_refsource_confirm
https://issues.apache.org/jira/browse/DAEMON-214
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49143
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46030
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-5.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1292.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=139344343412337&w=2
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743

Scores

EPSS 0.0724
EPSS Percentile 93.6%

Details

CWE
CWE-264
Status published
Products (27)
apache/apache_commons_daemon 1.0.3
apache/apache_commons_daemon 1.0.4
apache/apache_commons_daemon 1.0.5
apache/apache_commons_daemon 1.0.6
apache/tomcat 5.5.32
apache/tomcat 5.5.33
apache/tomcat 6.0.30
apache/tomcat 6.0.31
apache/tomcat 6.0.32
apache/tomcat 7.0.0 (2 CPE variants)
... and 17 more
Published Aug 15, 2011
Tracked Since Feb 18, 2026