CVE-2017-11747: Medium severity Tinyproxy Project Tinyproxy vulnerability
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill cat /run/tinyproxy/tinyproxy.pid" command.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11747?
CVE-2017-11747 is classified as a medium severity vulnerability due to its potential impact on local user permissions.
How do I fix CVE-2017-11747?
To mitigate CVE-2017-11747, update Tinyproxy to version 1.8.5 or later, which addresses this issue.
What type of vulnerability is CVE-2017-11747?
CVE-2017-11747 is a privilege escalation vulnerability.
Who is affected by CVE-2017-11747?
CVE-2017-11747 affects all versions of Tinyproxy up to and including 1.8.4.
What can an attacker do with CVE-2017-11747?
An attacker can exploit CVE-2017-11747 to modify the tinyproxy.pid file and potentially kill arbitrary processes.