Tor Directory Authorities Directory Queries Remote Information Disclosure Vulnerability

Bugtraq ID:	37901
Class:	Design Error
CVE:	CVE-2010-0383 CVE-2010-0385
Remote:	Yes
Local:	No
Published:	Jan 21 2010 12:00AM
Updated:	Apr 13 2015 09:03PM
Credit:	Reported by the vendor
Vulnerable:	Tor Tor 0.2 .35 Tor Tor 0.2 .34 Tor Tor 0.2 .33 Tor Tor 0.2 .32 Tor Tor 0.2 .31 Tor Tor 0.1.2 14 Tor Tor 0.1.1 23 Tor Tor 0.1.1 .5-alpha Tor Tor 0.1.1 .4-alpha Tor Tor 0.1.1 .3-alpha Tor Tor 0.1.1 .20 Tor Tor 0.1.1 .2-alpha Tor Tor 0.1.1 .1-alpha Tor Tor 0.1 18 Tor Tor 0.1 .0.14 Tor Tor 0.1 .0.13 Tor Tor 0.1 .0.12 Tor Tor 0.1 .0.11 Tor Tor 0.1 .0.10 Tor Tor 0.0.9 .9 Tor Tor 0.0.9 .8 Tor Tor 0.0.9 .7 Tor Tor 0.0.9 .6 Tor Tor 0.0.9 .5 Tor Tor 0.0.9 .4 Tor Tor 0.0.9 .3 Tor Tor 0.0.9 .2 Tor Tor 0.0.9 .10 Tor Tor 0.0.9 .1 Tor Tor 0.0.9 Tor Tor 0.2.1.21 Tor Tor 0.2.1.20 Tor Tor 0.1.2.16 Tor Tor 0.1.2.15 Tor Tor 0.1.2.1 alpha-cvs
Not Vulnerable:	Tor Tor 0.2.1.22

Tor Directory Authorities Directory Queries Remote Information Disclosure Vulnerability

Tor is prone to a remote information-disclosure vulnerability.

Exploits will allow attackers to obtain sensitive information that can help them launch further attacks.

NOTE: Since certain Tor infrastructures were compromised, new version 3 identity keys have been issued.

Versions prior to Tor 0.2.1.22 are vulnerable.

Tor Directory Authorities Directory Queries Remote Information Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

Tor Directory Authorities Directory Queries Remote Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.

Tor Directory Authorities Directory Queries Remote Information Disclosure Vulnerability

References:

• Tor Homepage (Tor Project)
  
• Tor Project infrastructure updates in response to security breach (Tor)