CVE ID:	CVE-2011-2729
Description:	native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Test IDs:	1.3.6.1.4.1.25623.1.0.863466   1.3.6.1.4.1.25623.1.0.70160   1.3.6.1.4.1.25623.1.0.863993   1.3.6.1.4.1.25623.1.0.840836   1.3.6.1.4.1.25623.1.0.71030   1.3.6.1.4.1.25623.1.0.103202
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2011-2729 1025925 http://securitytracker.com/id?1025925 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat) http://www.securityfocus.com/archive/1/519263/100/0/threaded 46030 http://secunia.com/advisories/46030 49143 http://www.securityfocus.com/bid/49143 57126 http://secunia.com/advisories/57126 HPSBOV02762 http://marc.info/?l=bugtraq&m=133469267822771&w=2 HPSBST02955 http://marc.info/?l=bugtraq&m=139344343412337&w=2 HPSBUX02725 http://marc.info/?l=bugtraq&m=132215163318824&w=2 HPSBUX02860 http://marc.info/?l=bugtraq&m=136485229118404&w=2 RHSA-2011:1291 http://www.redhat.com/support/errata/RHSA-2011-1291.html RHSA-2011:1292 http://www.redhat.com/support/errata/RHSA-2011-1292.html SSRT100627 http://marc.info/?l=bugtraq&m=132215163318824&w=2 SSRT100825 http://marc.info/?l=bugtraq&m=133469267822771&w=2 SSRT101146 http://marc.info/?l=bugtraq&m=136485229118404&w=2 [commons-dev] 20110812 [AANNOUNCE] Apache Commons Daemon 1.0.7 released http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E [tomcat-announce] 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat) http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306%40apache.org%3E [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch http://svn.apache.org/viewvc?view=revision&revision=1152701 http://svn.apache.org/viewvc?view=revision&revision=1152701 http://svn.apache.org/viewvc?view=revision&revision=1153379 http://svn.apache.org/viewvc?view=revision&revision=1153379 http://svn.apache.org/viewvc?view=revision&revision=1153824 http://svn.apache.org/viewvc?view=revision&revision=1153824 http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html http://tomcat.apache.org/security-7.html https://bugzilla.redhat.com/show_bug.cgi?id=730400 https://bugzilla.redhat.com/show_bug.cgi?id=730400 https://issues.apache.org/jira/browse/DAEMON-214 https://issues.apache.org/jira/browse/DAEMON-214 openSUSE-SU-2011:1062 http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html oval:org.mitre.oval:def:14743 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743 oval:org.mitre.oval:def:19450 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450 tomcat-jsvc-info-disclosure(69161) https://exchange.xforce.ibmcloud.com/vulnerabilities/69161