CVE-2017-11747
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill `cat /run/tinyproxy/tinyproxy.pid`" command.
El archivo main.c en Tinyproxy versión 1.8.4 y anteriores, crea un archivo /run/tinyproxy/tinyproxy.pid después de quitar los privilegios a una cuenta no root, lo que podría permitir a los usuarios locales eliminar procesos arbitrarios mediante el aprovechamiento del acceso a esta cuenta no root para la modificación de Tinyproxy.pid antes de que un script root ejecute el comando "kill` cat/run/tinyproxy/tinyproxy.pid`".
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-07-30 CVE Reserved
- 2017-07-30 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2020/03/msg00037.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/tinyproxy/tinyproxy/issues/106 | 2020-03-31 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Tinyproxy Project Search vendor "Tinyproxy Project" | Tinyproxy Search vendor "Tinyproxy Project" for product "Tinyproxy" | <= 1.8.4 Search vendor "Tinyproxy Project" for product "Tinyproxy" and version " <= 1.8.4" | - |
Affected
| ||||||