[Secure-testing-team] Bug#870307: tinyproxy: CVE-2017-11747: Creating PID file after privileges dropping allows local DoS

[Salvatore Bonaccorso]

Source: tinyproxy
Version: 1.8.3-3
Severity: normal
Tags: upstream security
Forwarded: https://github.com/tinyproxy/tinyproxy/issues/106

Hi,

the following vulnerability was published for tinyproxy, opeing this
in the BTS for tracking purposes.

CVE-2017-11747[0]:
| main.c in Tinyproxy 1.8.4 and earlier creates a
| /run/tinyproxy/tinyproxy.pid file after dropping privileges to a
| non-root account, which might allow local users to kill arbitrary
| processes by leveraging access to this non-root account for
| tinyproxy.pid modification before a root script executes a "kill `cat
| /run/tinyproxy/tinyproxy.pid`" command.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11747
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11747

Regards,
Salvatore