A bug in the capabilities code of tomcat5 [1] and tomcat6 [1] was identified in jsvc (the service wrapper for Linux that is part of the Commons Daemon project). jsvc would not drop capabilities, allowing the application to access files and directories owned by the superuser. The vulnerability only occurred when the following conditions were true:

Tomcat is running on Linux jsvc is compiled with libcap -user parameter is used

This affects Tomcat 6.0.30-6.0.32 and is fixed in r1153824 [3] and Tomcat 5.5.32-5.5.33, a proposed patch is available [4], however all these do is update the build files to use the latest Apache Commons Daemon. The real flaw is in the Apache Commons Daemon, and is fixed in upstream 1.0.7 [5]. According to the bug report [6] Commons Daemon 1.0.3-1.0.6 are affected and it is fixed in r11152701 [7].

[1] http://tomcat.apache.org/security-5.html [2] http://tomcat.apache.org/security-6.html [3] http://svn.apache.org/viewvc?view=revision&revision=1153824 [4] http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch [5] http://mail-archives.apache.org/modmbox/commons-dev/201108.mbox/%3C4E451B2B.9090108@apache.org%3E [6] https://issues.apache.org/jira/browse/DAEMON-214 [7] http://svn.apache.org/viewvc?view=revision&revision=1152701