Home > Vulnerability Database > CVE-2011-2729

Mend.io Vulnerability Database

CVE-2011-2729

Date: August 15, 2011

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

Language: C

Severity Score

4.8

Related Resources (32)

Url: http://mail-archives.apache.org/mod_mbox/commons-dev/201108.mbox/%3C4E451B2B.9090108%40apache.org%3E

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14743

Url: http://tomcat.apache.org/security-5.html

Url: http://svn.apache.org/viewvc?view=revision&revision=1153379

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19450

Url: http://marc.info/?l=bugtraq&m=139344343412337&w=2

Url: http://marc.info/?l=bugtraq&m=133469267822771&w=2

Url: http://securitytracker.com/id?1025925

Url: http://svn.apache.org/viewvc?view=revision&revision=1153824

Url: http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00024.html

Url: https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-2729

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/69161

Url: https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Url: http://secunia.com/advisories/57126

Url: http://tomcat.apache.org/security-7.html

Url: https://issues.apache.org/jira/browse/DAEMON-214

Url: http://www.redhat.com/support/errata/RHSA-2011-1292.html

Url: http://secunia.com/advisories/46030

Url: http://marc.info/?l=bugtraq&m=132215163318824&w=2

Url: http://marc.info/?l=bugtraq&m=136485229118404&w=2

Url: http://svn.apache.org/viewvc?view=revision&revision=1152701

Url: https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Url: https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Url: https://bugzilla.redhat.com/show_bug.cgi?id=730400

Url: http://tomcat.apache.org/security-6.html

Url: http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch

Url: http://www.securityfocus.com/bid/49143

Url: http://www.redhat.com/support/errata/RHSA-2011-1291.html

Url: http://www.securityfocus.com/archive/1/519263/100/0/threaded

Url: http://mail-archives.apache.org/mod_mbox/tomcat-announce/201108.mbox/%3C4E45221D.1020306%40apache.org%3E

Url: https://www.mend.io/vulnerability-database/CVE-2011-2729

Severity Score

4.8

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:	4.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-2729

Date: August 15, 2011

Language: C

Severity Score

Related Resources (32)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?