Gentoo Archives: gentoo-announce

From: Sean Amoss <ackle@g.o>
To: gentoo-announce@l.g.o
Cc: bugtraq@×××××××××××××.com, full-disclosure@××××××××××××××.uk, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 201201-12 ] Tor: Multiple vulnerabilities
Date: Mon, 23 Jan 2012 20:34:13
Message-Id: 4F1DC155.3@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201201-12
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Tor: Multiple vulnerabilities
9 Date: January 23, 2012
10 Bugs: #388769, #394969
11 ID: 201201-12
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in Tor, the most severe of
19 which may allow a remote attacker to execute arbitrary code.
20
21 Background
22 ==========
23
24 Tor is an implementation of second generation Onion Routing, a
25 connection-oriented anonymizing communication service.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 net-misc/tor < 0.2.2.35 >= 0.2.2.35
34
35 Description
36 ===========
37
38 Multiple vulnerabilities have been discovered in Tor:
39
40 * When configured as client or bridge, Tor uses the same TLS
41 certificate chain for all outgoing connections (CVE-2011-2768).
42 * When configured as a bridge, Tor relays can distinguish incoming
43 bridge connections from client connections (CVE-2011-2769).
44 * An error in or/buffers.c could result in a heap-based buffer overflow
45 (CVE-2011-2778).
46
47 Impact
48 ======
49
50 A remote attacker could possibly execute arbitrary code or cause a
51 Denial of Service. Furthermore, a remote relay the user is directly
52 connected to may be able to disclose anonymous information about that
53 user or enumerate bridges in the user's connection.
54
55 Workaround
56 ==========
57
58 There is no known workaround at this time.
59
60 Resolution
61 ==========
62
63 All Tor users should upgrade to the latest version:
64
65 # emerge --sync
66 # emerge --ask --oneshot --verbose ">=net-misc/tor-0.2.2.35"
67
68 References
69 ==========
70
71 [ 1 ] CVE-2011-2768
72 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2768
73 [ 2 ] CVE-2011-2769
74 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2769
75 [ 3 ] CVE-2011-2778
76 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2778
77
78 Availability
79 ============
80
81 This GLSA and any updates to it are available for viewing at
82 the Gentoo Security Website:
83
84 http://security.gentoo.org/glsa/glsa-201201-12.xml
85
86 Concerns?
87 =========
88
89 Security is a primary focus of Gentoo Linux and ensuring the
90 confidentiality and security of our users' machines is of utmost
91 importance to us. Any security concerns should be addressed to
92 security@g.o or alternatively, you may file a bug at
93 https://bugs.gentoo.org.
94
95 License
96 =======
97
98 Copyright 2012 Gentoo Foundation, Inc; referenced text
99 belongs to its owner(s).
100
101 The contents of this document are licensed under the
102 Creative Commons - Attribution / Share Alike license.
103
104 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature