CVE-2017-11565 Security feature bypass in n/a
Attackers can bypass AppArmor restrictions on Tor by exploiting a flawed init script path assumption in specific Debian configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11565?
CVE-2017-11565 is a high-severity vulnerability in n/a, published on 23 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
debian/tor.init in the Debian tor_0.2.9.11-1~deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly (with a wrong assumption that the specific pathname would remain the same forever), which allows attackers to bypass intended AppArmor restrictions by leveraging the silent loss of this protection mechanism. NOTE: this does not affect systems, such as default Debian stretch installations, on which Tor startup relies on a systemd unit file (instead of this tor.init script).
Which versions are affected by CVE-2017-11565?
It affects 1 product.
Products include Debian Tor.
How do I fix CVE-2017-11565?
Apply the vendor's patch.
Is CVE-2017-11565 being exploited?
There is no known exploitation of CVE-2017-11565 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2017-11565, GHSA-v9q4-769r-h63j, UBUNTU-CVE-2017-11565.