Tor Multiple Denial of Service Vulnerabilities

Bugtraq ID:	64650
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 08 2013 12:00AM
Updated:	Oct 08 2013 12:00AM
Credit:	nickm, torland, Roger, Rob Jansen and Florian Tschorsch
Vulnerable:	Tor Tor 0.2.4.15-rc Tor Tor 0.2.4.12-alpha
Not Vulnerable:	Tor Tor 0.2.4.16-rc Tor Tor 0.2.4.13-alpha

Tor Multiple Denial of Service Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Tor Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Tor Multiple Denial of Service Vulnerabilities

References:

• #8833 closed defect (fixed) Crash on directory authority in dirserv_query_measu (nickm)
  
• #9063 closed defect (fixed) #6252 didn't go far enough (arma)
  
• #9337 closed defect (fixed) Tor 0.2.4.14-alpha stopped with assertion (torland)
  
• Avoid assertion failure on unexepcted address family in DNS reply (Nick Mathewson)
  
• Changes in version 0.2.4.20 - 2013-12-22 (Tor Project)
  
• Fix 8833: crash bug from using NULL node->ri in dirserv.c (Nick Mathewson)
  
• Tor Homepage (Tor Project)