BID:19795

Tor Multiple Buffer Overflow/Information Disclosure/Denial of Service Vulnerabilities

CVE-2006-3407 |

Info

Tor Multiple Buffer Overflow/Information Disclosure/Denial of Service Vulnerabilities

Bugtraq ID:	19795
Class:	Unknown
CVE:	CVE-2006-3407 CVE-2006-0414
Remote:	Yes
Local:	No
Published:	Jul 06 2006 12:00AM
Updated:	Sep 05 2006 05:53PM
Credit:	These issues were disclosed by the vendor.
Vulnerable:	Tor Tor 0.1.1 .5-alpha Tor Tor 0.1.1 .4-alpha Tor Tor 0.1.1 .3-alpha Tor Tor 0.1.1 .2-alpha Tor Tor 0.1.1 .1-alpha Tor Tor 0.1 18 Tor Tor 0.1 .0.14 Tor Tor 0.1 .0.13 Tor Tor 0.1 .0.12 Tor Tor 0.1 .0.11 Tor Tor 0.1 .0.10 Tor Tor 0.0.9 .9 Tor Tor 0.0.9 .8 Tor Tor 0.0.9 .7 Tor Tor 0.0.9 .6 Tor Tor 0.0.9 .5 Tor Tor 0.0.9 .4 Tor Tor 0.0.9 .3 Tor Tor 0.0.9 .2 Tor Tor 0.0.9 .10 Tor Tor 0.0.9 .1 Tor Tor 0.0.9

Not Vulnerable:	Tor Tor 0.1.1 .20

Discussion

Tor Multiple Buffer Overflow/Information Disclosure/Denial of Service Vulnerabilities

Tor is affected by multiple vulnerabilities, including an integer overflow, a denial of service, information disclosure, and a possible log-bypass vulnerability.

An attacker can exploit these issues to retrieve sensitive information, crash the affected application, and potentially gain remote access to the underlying computer.

Exploit / POC

Tor Multiple Buffer Overflow/Information Disclosure/Denial of Service Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Some of these issues may not require exploit code; attackers may use standard networking tools.

Solution / Fix

Tor Multiple Buffer Overflow/Information Disclosure/Denial of Service Vulnerabilities

Solution:
The vendor has released version 0.1.1.20 to address these issues.

Please see the referenced advisories for more information.

Tor Tor 0.0.9 .3