ID

VAR-201001-0712

CVE

CVE-2010-0383

TITLE

Tor official directory query request information disclosure vulnerability

DESCRIPTION

Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity keys for certain directory authorities, which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations. Tor (The Onion Router) is an implementation of the second generation of onion routing software, through which users can communicate anonymously over the Internet. If the user submits a specially made query request to the bridge official directory, the directory authority will reveal all the tracked bridge identities in the response of dbg-stability.txt, which is an information disclosure. Tor is prone to a remote information-disclosure vulnerability. Exploits will allow attackers to obtain sensitive information that can help them launch further attacks. NOTE: Since certain Tor infrastructures were compromised, new version 3 identity keys have been issued. Versions prior to Tor 0.2.1.22 are vulnerable. ---------------------------------------------------------------------- Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/ ---------------------------------------------------------------------- TITLE: Tor Directory Authorities Directory Queries Information Disclosure SECUNIA ADVISORY ID: SA38198 VERIFY ADVISORY: http://secunia.com/advisories/38198/ DESCRIPTION: A security issue has been reported in Tor, which can be exploited by malicious people to disclose potentially sensitive information. SOLUTION: Update to version 0.2.1.22. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://permalink.gmane.org/gmane.network.onion-routing.announce/30 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

information disclosure

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Roger Dingledine

SOURCES

LAST UPDATE DATE

2025-04-11T22:59:43.286000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE