jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

Fedora Update for apache-commons-daemon FEDORA-2011-10936

Check for the Version of apache-commons-daemon OpenVAS Vulnerability Test Fedora Update for apache-commons-daemon FEDORA-2011-10936 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Fedora 15 : apache-commons-daemon-1.0.7-1.fc15 (2011-10936)

This update fixes several bugs and also security issue CVE-2011-2729. Users are encouraged to update as soon as possible. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Fedora 16 : apache-commons-daemon-1.0.7-1.fc16 (2011-10880)

This update fixes several bugs and also security issue CVE-2011-2729. Users are encouraged to update as soon as possible. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

[SECURITY] Fedora 16 Update: apache-commons-daemon-1.0.7-1.fc16

The scope of this package is to define an API in line with the current Java Platform APIs to support an alternative invocation mechanism which could be used instead of the public static void mainString method. This specification covers the behavior and life cycle of what we define as Java daemons...

Creative Commons SQL Injection

By : CR9 Greetz : Perspicacious Hackers In The World . ++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : Creative Commons SQL Injection Vulnerability Vendor : http://creativecommons.org Author : CR9 Home : Http://Nopotm.ir Archive : Http://Nopotm.ir/forums Email :...

Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability

Apache Commons Daemon is prone to a remote information-disclosure vulnerability that affects the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

[SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)

CVE-2011-2729: Commons Daemon fails to drop capabilities Apache Tomcat Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.19 Tomcat 6.0.30 to 6.0.32 Tomcat 5.5.32 to 5.5.33 Description: Due to a bug in the capabilities code, jsvc the service wrapper...

Apache Tomcat 7.0.0 < 7.0.20

The version of Tomcat installed on the remote host is prior to 7.0.20. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.20security-7 advisory. - native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used i...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

DEBIAN-CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

Authentication flaw

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

CVE-2011-2729

CVE-2011-2729 affects the Jakarta Commons Daemon jsvc component in Tomcat runtimes (Tomcat 5.5.32–5.5.33, 6.0.30–6.0.32, and 7.0.x before 7.0.20) where jsvc did not properly drop capabilities. This allows a remote attacker to bypass read permissions for files via an application request. The root ...

PT-2011-4045

Name of the Vulnerable Software and Affected Versions Apache Commons Daemon jsvc versions 1.0.3 through 1.0.6 Apache Tomcat versions 5.5.32 through 5.5.33 Apache Tomcat versions 6.0.30 through 6.0.32 Apache Tomcat versions 7.0.x before 7.0.20 Description The issue arises from a bug in the...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

Fixed in Apache Tomcat 7.0.20

Important: Information disclosure CVE-2011-2729 Due to a bug in the capabilities code, jsvc the service wrapper for Linux that is part of the Commons Daemon project does not drop capabilities allowing the application to access files and directories owned by superuser. This vulnerability only occu...

Microsoft Word 2003 - Record Parsing Buffer Overflow (MS09-027) (Metasploit)

$Id: ms09-027 10477 2011-04-13 11:59:02Z mc $ This file is not part of the Metasploit Framework and may not be subject to redistribution and commercial restrictions. TODO some testing to find the real banned characters and maxlen add those parameters to the .rb file drop in appropriate directory...