Skip to Content.
Sympa Menu

sm-security - [SM-Security] Tor: Information disclosure

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] Tor: Information disclosure
  • Date: Sun, 28 Aug 2005 23:06:29 +0200

Synopsis
========
Tor clients can lose anonymity, confidentiality, and data integrity if
the first Tor server in their path is malicious.

Background
==========
tor is an anonymous Internet communication system.

Description
===========
CAN-2005-2643:
Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and
earlier, does not reject certain weak keys when using ephemeral
Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to
obtain the keys that a client uses for other systems in the circuit.

Affected packages
=================
tor in stable-rc 0.2 and stable 0.1 grimoires is affected. This is now
fixed in all grimoires.

Resolution
==========
All tor users should upgrade to the latest available version:
# scribe update
# cast -c tor

References
==========
[ 1 ] CAN-2005-2643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2643
[ 2 ] Tor security advisory: DH handshake flaw
http://archives.seul.org/or/announce/Aug-2005/msg00002.html


--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] Tor: Information disclosure, Thomas Houssin, 08/28/2005

Archive powered by MHonArc 2.6.24.

Top of Page