CVE-2004-1452: Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat,...

Security readout for executives and security teams

This is an old Gentoo Linux packaging flaw in Tomcat. The Tomcat service scripts could be editable by the tomcat group but later run with root privileges. A local user in that group could turn ordinary system access into root control. Exposure is most likely on legacy Gentoo systems or old images that installed the affected Tomcat package. It requires local access and membership or equivalent write access to the tomcat group-controlled init scripts. Prioritize if any legacy Gentoo Tomcat hosts remain, especially shared systems. The business risk is full host compromise from a local foothold, but scope is narrow and evidence of active exploitation is not provided. Mitigation focus: Upgrade Gentoo Tomcat to 5.0.27-r3 or later where applicable.; Review Gentoo GLSA-200408-15 and apply the vendor-recommended package update.; Remove unnecessary users from the tomcat group..

Prepared

Jun 30, 2026, 00:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.