Debian LTS: Security Advisory for tinyproxy (DLA-2163-1)

The remote host is missing an update for the 'tinyproxy' package(s) announced via the DLA-2163-1 advisory.

A minor security issue and a severe packaging bug have been fixed in tinyproxy, a lightweight http proxy daemon. CVE-2017-11747 main.c in Tinyproxy created a /var/run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might have allowed local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executed a 'kill `cat /run/tinyproxy/tinyproxy.pid`' command. OTHER Furthermore, a severe flaw had been discovered by Tim Duesterhus in Debian's init script for tinyproxy. With the tiny.conf configuration file having the PidFile option removed, the next run of logrotate (if installed) would have changed the owner of the system's base directory ('/') to tinyproxy:tinyproxy.

'tinyproxy' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 8 'Jessie', this problem has been fixed in version 1.8.3-3+deb8u1. These fixes were prepared by Mike Gabriel. We recommend that you upgrade your tinyproxy packages.