A vulnerability was found in Tor 0.2.4.9-alpha (Network Encryption Software). It has been rated as critical. Affected by this issue is the function relay_lookup_conn of the component Crafted Create/Relay Cell Handler. The manipulation of the argument RELAY_COMMAND_BEGIN/RELAY_COMMAND_BEGIN_DIR/RELAY_COMMAND_RESOLVE with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was presented 01/08/2013 by oftc_must_be_destroyed as Ticket #7889 as not defined bug report (Website). The advisory is shared for download at trac.torproject.org. The attack may be launched remotely. There are known technical details, but no exploit is available. The following code is the reason for this vulnerability:

if (test_stream_id == 0)
    goto again;

Upgrading to version 0.2.4.10-alpha eliminates this vulnerability. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability.

See 11707 for similar entry.

Productinfo

Type

• Network Encryption Software

Name

• Tor

Version

• 0.2.4.9-alpha

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion