The tomcat processes, as installed, run as the user/group www:www. This is
fine. However, looking at the ports (all of the tomcat ports, and this problem
extends to other java ports too), the install scripts are overly generous in
giving away installed files to www:www.

This is problematic because it means that the process (and, in the absence of a
properly-configured policy file - note jboss ports install a policy file, but
it permits "anything") can write to its own executables - including the
"tomcat50ctl" file. Thus, malicious webapps can "leak" out and corrupt their
container. It's not really an example of "defense in depth".

Additionally, you're at risk from any other process running under www:www - for
example, a CGI script.

Fix: 

The first permission problem is pretty straightforward, and can be fixed by
only giving the tomcat user (www:www) ownership to the webapps, work, temp and
logs subdirectories - everything else can be owned by root.

When it comes to it, a slightly smarter tomcat*ctl program can be made suid
root rather than sugid www:www; capturing the tomcat process PID isn't overly
difficult. Fixing the "executable" parts of the tomcat, jboss installations to
be immutable to non-root users would be a great start however.
How-To-Repeat: Install any jakarta-tomcat, or jboss (or possibly other, that's as far as I've
checked) port.