CVE-2011-2729

2011-08-1500:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

57.3%

JSON

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3
through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through
5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not
drop capabilities, which allows remote attackers to bypass read permissions
for files via a request to an application.

Bugs

Notes

Author	Note
mdeslaur	tomcat isn’t built with commons
jdstrand	according to upstream, needs to be built with libcap to be affected. Only Ubuntu 11.04 and later are built with libcap.

OSVersionArchitecturePackageVersionFilename
ubuntu11.04noarchcommons-daemon< 1.0.4-1ubuntu0.1UNKNOWN
ubuntu11.10noarchcommons-daemon< 1.0.6-1ubuntu0.1UNKNOWN