CVE-2011-2729: Medium severity apache commons daemon vulnerability
A bug in the capabilities code of tomcat5 [1] and tomcat6 [1] was identified in jsvc (the service wrapper for Linux that is part of the Commons Daemon project). jsvc would not drop capabilities, allowing the application to access files and directories owned by the superuser. The vulnerability only occurred when the following conditions were true:
Tomcat is running on Linux jsvc is compiled with libcap -user parameter is used
This affects Tomcat 6.0.30-6.0.32 and is fixed in r1153824 [3] and Tomcat 5.5.32-5.5.33, a proposed patch is available [4], however all these do is update the build files to use the latest Apache Commons Daemon. The real flaw is in the Apache Commons Daemon, and is fixed in upstream 1.0.7 [5]. According to the bug report [6] Commons Daemon 1.0.3-1.0.6 are affected and it is fixed in r11152701 [7].
[1] http://tomcat.apache.org/security-5.html [2] http://tomcat.apache.org/security-6.html [3] http://svn.apache.org/viewvc?view=revision&revision=1153824 [4] http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch [5] http://mail-archives.apache.org/modmbox/commons-dev/201108.mbox/%3C4E451B2B.9090108@apache.org%3E [6] https://issues.apache.org/jira/browse/DAEMON-214 [7] http://svn.apache.org/viewvc?view=revision&revision=1152701
Other sources
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2729?
CVE-2011-2729 is considered a high severity vulnerability due to its potential to allow unauthorized access to superuser files.
How do I fix CVE-2011-2729?
To fix CVE-2011-2729, it is recommended to update Apache Tomcat and Apache Commons Daemon to the latest versions available.
Which versions are affected by CVE-2011-2729?
CVE-2011-2729 affects Apache Tomcat versions 5.5.32, 5.5.33, and 6.0.30 to 6.0.32.
Can CVE-2011-2729 affect my web applications?
Yes, CVE-2011-2729 can affect web applications running on vulnerable versions of Apache Tomcat, potentially compromising file security.
Is there a workaround for CVE-2011-2729?
A possible workaround for CVE-2011-2729 is to limit user permissions and implement stricter access controls on system files.