CVE-2011-2729 Security feature bypass in n/a
Remote attackers can bypass file read permissions in Apache Tomcat via jsvc because it fails to drop capabilities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-2729?
CVE-2011-2729 is a medium-severity vulnerability in Apache Tomcat, published on 15 Aug 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Weakness: CWE-264
Which versions are affected by CVE-2011-2729?
It affects 2 products.
Linux distribution packages (3)
jakarta-commons-daemon-jsvc Red Hat:jboss_enterprise_web_server:1::el4 | All versions | 1:1.0.5-1.5.patch01.ep5.el4 |
jakarta-commons-daemon-jsvc-debuginfo Red Hat:jboss_enterprise_web_server:1::el4 | All versions | 1:1.0.5-1.5.patch01.ep5.el4 |
apache-commons-daemon openSUSE:Tumbleweed | All versions | 1.0.15-7.7 |
Products include Apache Apache Commons Daemon, Apache Tomcat.
How do I fix CVE-2011-2729?
Upgrade to a fixed version.
Is CVE-2011-2729 being exploited?
There is no known exploitation of CVE-2011-2729 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2011-2729, GHSA-7mg3-pr99-8rh7, RHSA-2011:1292, openSUSE-SU-2024:10167-1.