Fixed in Apache Tomcat 7.0.20

Important: Information disclosure CVE-2011-2729

Due to a bug in the capabilities code, jsvc (the service wrapper for Linux that is part of the Commons Daemon project) does not drop capabilities allowing the application to access files and directories owned by superuser. This vulnerability only occurs when all of the following are true:

• Tomcat is running on a Linux operating system
• jsvc was compiled with libcap
• -user parameter is used

Affected Tomcat versions shipped with source files for jsvc that included this vulnerability.

This was fixed in revision 1153379.

This was identified by Wilfried Weissmann on 20 July 2011 and made public on 12 August 2011.

Affects: 7.0.0-7.0.19