PT-2017-2588 · Canonical+1 · Apparmor+1

Luciano Bello + 1 · Published 2017-07-23 · Updated 2019-10-03 · CVE-2017-11565

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tor version 0.2.9.11-1~deb9u1

Description The issue is related to the debian/tor.init script in the Tor package, which was designed to execute aa-exec from the standard system pathname if the apparmor package is installed. However, the script implements this incorrectly, assuming the specific pathname would remain the same forever. This allows attackers to bypass intended AppArmor restrictions by leveraging the silent loss of this protection mechanism. The issue does not affect systems where Tor startup relies on a systemd unit file, such as default Debian stretch installations.

Recommendations For Tor version 0.2.9.11-1~deb9u1, consider disabling the execution of aa-exec from the standard system pathname until a corrected version of the tor.init script is available. As a temporary workaround, restrict access to the vulnerable script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01801

CVE-2017-11565

Affected Products

Apparmor

Tor

References · 11

• https://bdu.fstec.ru/vul/2017-01801 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11565 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-11565 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11565 · Vendor Advisory
• https://bugs.debian.org/869153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11565 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-11565 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11565 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11565 · Vendor Advisory
• http://securityfocus.com/bid/99933 · Note
• https://twitter.com/pissquark/status/888142796414226432 · Note