CVE Vulnerabilities

CVE-2017-11747

Improper Privilege Management

Published: Jul 30, 2017 | Modified: Nov 21, 2024
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
2.1 LOW
AV:L/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a kill cat /run/tinyproxy/tinyproxy.pid command.

Weakness 

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software 

Name Vendor Start Version End Version
Tinyproxy Tinyproxy_project * 1.8.4 (including)
Tinyproxy Ubuntu artful *
Tinyproxy Ubuntu bionic *
Tinyproxy Ubuntu esm-apps/bionic *
Tinyproxy Ubuntu esm-apps/xenial *
Tinyproxy Ubuntu trusty *
Tinyproxy Ubuntu trusty/esm *
Tinyproxy Ubuntu upstream *
Tinyproxy Ubuntu xenial *
Tinyproxy Ubuntu zesty *

Potential Mitigations 

References