BID:14659

Tor Cryptographic Handshake Remote Information Disclosure Vulnerability

Info

Tor Cryptographic Handshake Remote Information Disclosure Vulnerability

Bugtraq ID:	14659
Class:	Design Error
CVE:	CVE-2005-2643
Remote:	Yes
Local:	No
Published:	Aug 25 2005 12:00AM
Updated:	Jul 12 2009 05:06PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Tor Tor 0.1.1 .4-alpha Tor Tor 0.1.1 .3-alpha Tor Tor 0.1.1 .2-alpha Tor Tor 0.1.1 .1-alpha Tor Tor 0.1 .0.13 Tor Tor 0.1 .0.12 Tor Tor 0.1 .0.11 Tor Tor 0.1 .0.10 Gentoo Linux

Not Vulnerable:	Tor Tor 0.1.1 .5-alpha Tor Tor 0.1 .0.14

Discussion

Tor Cryptographic Handshake Remote Information Disclosure Vulnerability

Tor is susceptible to a remote information disclosure vulnerability. This issue is due to a flaw in the implementation of the Diffie-Hellman key exchange protocol.

Specifically, certain values used during the Diffie-Hellman key exchange protocol are insecure, and when used, lead to the ability of attackers to access the negotiated encryption keys.

This vulnerability allows attackers to gain access to the negotiated keys used to encrypt the communications between Tor servers and clients. This allows attackers to read or modify all the traffic that is sent from the targeted user over the Tor network. The anonymity, confidentiality, and integrity guarantees of the network are lost through the exploitation of this issue.

Exploit / POC

Tor Cryptographic Handshake Remote Information Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Tor Cryptographic Handshake Remote Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and fixes to address this issue. Please see the referenced advisory for further information.

Gentoo Linux has released advisory GLSA 200508-16 to address this issue. Users of affected packages are urged to execute the following commands with superuser privileges:
emerge --sync
emerge --ask --oneshot --verbose ">=net-misc/tor-0.1.0.14"
Please see the referenced advisory for further information.

Tor Tor 0.1 .0.13