native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

jsvc did not properly drop capabilities, therefore allowing applications to access files owned by the super user (CVE-2011-2729).

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

Wilfried Weissmann discovered that Apache Commons Daemon incorrectly dropped capabilities after starting. A remote attacker could possibly use this flaw to read certain files, bypassing the intended permissions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.34. It is, there, affected by multiple vulnerabilities :

  - Several weaknesses were found in the HTTP Digest     authentication implementation. The issues are as     follows: replay attacks are possible, server nonces     are not checked, client nonce counts are not checked,     'quality of protection' (qop) values are not checked,     realm values are not checked and the server secret is     a hard-coded, known string. The effect of these issues     is that Digest authentication is no stronger than Basic     authentication. (CVE-2011-1184, CVE-2011-5062,     CVE-2011-5063, CVE-2011-5064)

  - An error handling issue exists related to the     MemoryUserDatabase that allows user passwords to be     disclosed through log files. (CVE-2011-2204)

  - An input validation error exists that allows a local     attacker to either bypass security or carry out denial     of service attacks when the APR or NIO connectors are     enabled. (CVE-2011-2526)

  - A component that Apache Tomcat relies on called 'jsvc'     contains an error in that it does not drop capabilities     after starting and can allow access to sensitive files     owned by the super user. Note this vulnerability only     affects Linux operating systems and only when 'jsvc' is     compiled with libpcap and the '-user' parameter is     used. (CVE-2011-2729)

  - Specially crafted requests are incorrectly processed by     Tomcat and can cause the server to allow injection of     arbitrary AJP messages. This can lead to authentication     bypass and disclosure of sensitive information. Note     this vulnerability only occurs when the     org.apache.jk.server.JkCoyoteHandler AJP connector is     not used, POST requests are accepted, and the request     body is not processed.(CVE-2011-3190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Tomcat 6.x earlier than 6.0.33 are potentially affected by multiple vulnerabilities : 

  - An error handling issue exists related to the MemoryUserDatabase that allows user passwords to be disclosed through log files. (CVE-2011-2204)

  - An input validation error exists that allows a local attacker to either bypass security or carry out denial of service attacks when the APR or NIO connectors are enabled. (CVE-2011-2526)

  - A component that Apache Tomcat relies on called 'jsvc' contains an error in that it does not drop capabilities after starting and can allow access to sensitive files owned by the super user.  Note this vulnerability only affects Linux operating systems and only when the following are true:  jsvc is compiled with libpcap and the '-user' parameter is used. (CVE-2011-2729)

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.33. It is, therefore, affected by multiple vulnerabilities :

  - Several weaknesses were found in the HTTP Digest     authentication implementation. The issues are as     follows: replay attacks are possible, server nonces     are not checked, client nonce counts are not checked,     'quality of protection' (qop) values are not checked,     realm values are not checked and the server secret is     a hard-coded, known string. The effect of these issues     is that Digest authentication is no stronger than Basic     authentication. (CVE-2011-1184, CVE-2011-5062,     CVE-2011-5063, CVE-2011-5064)

  - An error handling issue exists related to the     MemoryUserDatabase that allows user passwords to be     disclosed through log files. (CVE-2011-2204)

  - An input validation error exists that allows a local     attacker to either bypass security or carry out denial     of service attacks when the APR or NIO connectors are     enabled. (CVE-2011-2526)

  - A component that Apache Tomcat relies on called 'jsvc'     contains an error in that it does not drop capabilities     after starting and can allow access to sensitive files     owned by the super user. Note this vulnerability only     affects Linux operating systems and only when the     following are true: jsvc is compiled with libpcap and     the '-user' parameter is used. (CVE-2011-2729)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several bugs and also security issue CVE-2011-2729.

Users are encouraged to update as soon as possible.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Tomcat 7.0.x earlier than 7.0.20 are potentially affected by an information disclosure vulnerability.  A component that Apache Tomcat relies on called 'jsvc' contains an error in that it does not drop capabilities after starting and can allow access to sensitive files owned by the super user.  Note that this vulnerability only affects Linux operating systems and only when the following are true : 

  - jsvc is compiled with libpcap.

  - The '-user' parameter is used

Versions of Tomcat 7.0.x earlier than 7.0.20 are potentially affected by an information disclosure vulnerability.  A component that Apache Tomcat relies on called 'jsvc' contains an error in that it does not drop capabilities after starting and can allow access to sensitive files owned by the super user.  Note that this vulnerability only affects Linux operating systems and only when the following are true : 

  - jsvc is compiled with libpcap.

  - The '-user' parameter is used

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.20. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.20_security-7 advisory.

  - native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as     used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does     not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to     an application. (CVE-2011-2729)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
75868	openSUSE Security Update : jakarta-commons-daemon (openSUSE-SU-2011:1062-1)	Nessus	SuSE Local Security Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57271	Ubuntu 11.04 / 11.10 : commons-daemon vulnerability (USN-1298-1)	Nessus	Ubuntu Local Security Checks	medium
56301	Apache Tomcat 5.5.x < 5.5.34 Multiple Vulnerabilities	Nessus	Web Servers	high
800602	Apache Tomcat 6.0.x < 6.0.33 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium
56008	Apache Tomcat 6.0.x < 6.0.33 Multiple Vulnerabilities	Nessus	Web Servers	medium
55988	Fedora 15 : apache-commons-daemon-1.0.7-1.fc15 (2011-10936)	Nessus	Fedora Local Security Checks	medium
55962	Fedora 16 : apache-commons-daemon-1.0.7-1.fc16 (2011-10880)	Nessus	Fedora Local Security Checks	medium
800615	Apache Tomcat 7.0.x < 7.0.20 'jsvc' Information Disclosure	Log Correlation Engine	Web Servers	medium
6007	Apache Tomcat 7.0.x < 7.0.20 'jsvc' Information Disclosure	Nessus Network Monitor	Web Servers	medium
55859	Apache Tomcat 7.0.0 < 7.0.20	Nessus	Web Servers	critical

Detections

Analytics

CVE-2011-2729

critical

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

critical