Critical Vulnerability in Tinyproxy: Insecure PID File Permissions
Summary
USN-4808-1: tinyproxy vulnerability. Affects tinyproxy versions < 1.8.3-3ubuntu14.04.1~esm1. Fixed in 1.8.3-3ubuntu14.04.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tinyproxy is a lightweight HTTP/HTTPS proxy daemon designed to be fast and efficient. It is commonly used in various applications to facilitate web traffic management and filtering. The package is known for its simplicity and ease of configuration, making it a popular choice among developers. However, a vulnerability has been identified that affects its security, specifically related to the handling of process ID (PID) files.
Vulnerability Detail
The vulnerability arises from Tinyproxy creating its PID file with insecure permissions. This flaw allows an attacker to manipulate the PID file, potentially leading to the termination of arbitrary processes. Such an action can result in a denial of service, impacting the availability of services relying on Tinyproxy. The vulnerability is tracked under CVE-2017-11747 and has been addressed in subsequent package updates.
How To Fix
Minimum fixed version
1.8.3-3ubuntu14.04.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tinyproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the PID file by modifying its permissions manually. Use the following command to set secure permissions:
sudo chmod 600 /var/run/tinyproxy.pid
This will limit access to the PID file, reducing the risk of exploitation until the package can be updated.
Conclusion
The identified vulnerability in Tinyproxy poses a significant risk due to insecure PID file permissions, which can lead to denial of service. It is crucial for users to update to the patched versions provided for their respective Ubuntu distributions to mitigate this risk. Additionally, temporary workarounds can be applied to enhance security until updates are implemented.
See every vulnerability recorded for tinyproxy →
FAQ
Tinyproxy is a lightweight HTTP/HTTPS proxy daemon that allows users to manage and filter web traffic efficiently.
The vulnerability involves insecure permissions on the PID file, which can be exploited to terminate processes, leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, affecting the availability of services that depend on Tinyproxy.
Ensure that you update Tinyproxy to the latest patched version and consider implementing additional security measures, such as restricting access to the PID file.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinyproxy.
