Tor - Security Update (DSA-3216-1)
Summary
DSA-3216-1: tor - security update. Affects tor versions < 0.2.4.27-1. Fixed in 0.2.4.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tor is a connection-based low-latency anonymous communication system. It allows users to browse the internet anonymously by routing their traffic through a network of volunteer-operated servers. Tor is designed to protect the privacy and anonymity of its users by encrypting and routing their internet traffic through multiple relays, making it difficult to trace back to the original source. However, several vulnerabilities have been discovered in Tor that could potentially compromise its security and anonymity features.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-2928, allows a malicious client to trigger an assertion failure in a Tor instance providing a hidden service. This assertion failure renders the hidden service inaccessible, potentially disrupting its availability to legitimate users. The second vulnerability, CVE-2015-2929, causes Tor clients to crash with an assertion failure when parsing specially crafted hidden service descriptors. This vulnerability could be exploited by an attacker to crash Tor clients, disrupting their ability to connect to hidden services.
How To Fix
Minimum fixed version
0.2.4.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade torTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. The recommended solution is to upgrade the Tor packages to the fixed versions.
Conclusion
Tor users should promptly upgrade their Tor packages to the fixed versions mentioned in the 'how_to_fix' section to mitigate the risk of these vulnerabilities. Upgrading to the latest version of Tor ensures that the identified vulnerabilities are addressed, enhancing the security and anonymity features of the Tor network. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tor →
FAQ
Tor is a connection-based low-latency anonymous communication system that allows users to browse the internet anonymously by routing their traffic through a network of volunteer-operated servers.
A hidden service in Tor refers to a website or service that is only accessible through the Tor network. These services are designed to provide anonymity to both the service provider and the users accessing the service.
The CVE-2015-2928 vulnerability allows a malicious client to trigger an assertion failure in a Tor instance providing a hidden service. This assertion failure renders the hidden service inaccessible, potentially disrupting its availability to legitimate users.
The CVE-2015-2929 vulnerability causes Tor clients to crash with an assertion failure when parsing specially crafted hidden service descriptors. This vulnerability could be exploited by an attacker to crash Tor clients, disrupting their ability to connect to hidden services.
To fix these vulnerabilities, it is recommended to upgrade the Tor packages to the fixed versions mentioned in the 'how_to_fix' section. Follow the standard package upgrade process for your operating system or package manager to ensure you are using the latest available version of Tor.
Related vulnerabilities
Recent vulnerabilities recorded for tor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
