Security readout for executives and security teams
Plain-English summary
Tinyproxy 1.8.4 and earlier may let a local user influence the PID file used by privileged scripts. If a root script trusts that file to stop Tinyproxy, the user could cause the script to kill another process, creating an availability risk.
Executive priority
Treat this as a targeted hardening and patch-management issue, not an internet-wide emergency. Prioritize shared systems, production proxies, and hosts where local account compromise would affect critical services.
Technical view
The issue is in Tinyproxy main.c: the PID file at /run/tinyproxy/tinyproxy.pid is created after dropping privileges. A local user able to modify that file through the Tinyproxy non-root account could affect later privileged PID consumption.
Likely exposure
Exposure is limited to systems running Tinyproxy 1.8.4 or earlier where local users can access the Tinyproxy service account or PID file path.
Exploitation context
The bundle does not show KEV listing or active exploitation. The described abuse requires local access plus a privileged script that trusts /run/tinyproxy/tinyproxy.pid for process termination.
Researcher notes
No CVSS, CWE, CPE, or normalized affected product data is provided in the bundle. The core evidence is the CVE description, upstream GitHub issue, and Debian LTS advisory reference.
Mitigation direction
- Inventory Tinyproxy deployments and identify versions 1.8.4 or earlier.
- Review vendor or distribution guidance, including Debian's Tinyproxy security update.
- Restrict access to the Tinyproxy service account and runtime directory.
- Avoid privileged operational scripts that blindly trust writable PID files.
- Apply supported Tinyproxy package updates where available from your distribution.
Validation and detection
- Check whether Tinyproxy is installed and determine the exact package version.
- Verify permissions on /run/tinyproxy and tinyproxy.pid.
- Review root-owned service scripts for trusted reads of the Tinyproxy PID file.
- Confirm whether local users can write through the Tinyproxy non-root account.
- Document distribution advisory status for each affected host.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/tinyproxy/tinyproxy/issues/106CVE reference · x_refsource_MISC
- [debian-lts-announce] 20200331 [SECURITY] [DLA 2163-1] tinyproxy security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.