Tor 0.2.5.1-alpha Pluggable Transport Helper util.c format_helper_exit_status Exit Status memory corruption

Summaryinfo

A vulnerability has been found in Tor 0.2.5.1-alpha and classified as critical. Affected is the function format_helper_exit_status of the file util.c of the component Pluggable Transport Helper. Performing a manipulation as part of Exit Status results in memory corruption. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as very critical has been found in Tor 0.2.5.1-alpha (Network Encryption Software). This affects the function format_helper_exit_status of the file util.c of the component Pluggable Transport Helper. The manipulation as part of a Exit Status leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 10/08/2013 by Pedro Ribeiro as #9928 as confirmed bug report (Trac). The advisory is shared at trac.torproject.org. The public release has been coordinated in cooperation with the project team. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/24/2019). The advisory points out:

After it has finished everything, it then checks again if there are more than 0 bytes left in the buffer. If there are, it writes two characters - a newline and a null terminator (lines 3342 to 3347). The problem here is if the buffer only has one byte left, an off by one overflow occurs. These usually are very hard to exploit, but can be a security issue nonetheless.

Upgrading to version 0.2.4.18-rc eliminates this vulnerability. The upgrade is hosted for download at gitweb.torproject.org. A possible mitigation has been published 2 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (101403†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Encryption Software

Name

• Tor

Version

• 0.2.5.1-alpha

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion