Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: tor DoS via SENDME cells
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 26 Nov 2012 11:43:43 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/26/2012 09:48 AM, Vincent Danen wrote:
I've not seen a CVE for this yet, could one get assigned?

It was reported that Tor suffered from a denial of service 
vulnerability due to an error when handling SENDME cells.  This
could be exploited to cause excessive consumption of memory
resources within an entry node.

This is fixed in upstream version 0.2.3.25.

References:

https://secunia.com/advisories/51329/ 
https://trac.torproject.org/projects/tor/ticket/6252 
https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16

 https://bugzilla.redhat.com/show_bug.cgi?id=880310 
https://bugs.gentoo.org/show_bug.cgi?id=444804

Thanks.

Please use Please use CVE-2012-5573 for this issue. for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQs7hfAAoJEBYNRVNeJnmTknAP/2Rv/H4SZe+YE1rB/zvPS+0C
3Jo6TSF95b94yKVuaqsktgB8kOUviSrzc0J9FvvzhB1RpheEhKZzBLDnlaS0GJ9+
hqWXnt4EyCEi6BNC1xyp88zrXeQdtJz5g6PTudaSHxTvIWPRINQjrZJEPSxk2EF1
PK0bHBKyjfdyKq9Yp3Gc84Q2XOqQ0TbbP5Eg9h+2twpm+2WakePm8kNmzF5iagPH
rvzg6FFE8egaUyM0Hc13N0d15d19VZ3XTNV20YH4wdfocSWeVIgoq34g2GZ7clf4
WukVkjbeS/y/fo4Bsubml8b6FHfUOS03+8+L99f8uAgAF2cn1gRE6+A/SBDko0QN
10etjn2g3HO0CWfGRcgPL9mVFLRYNdQTJKQY570Hp+OZHmsu2zwPVJb6RlRxFWzE
P7iCbu3ZUYUPDbIqsauTkn82efynttohJnBC7qksQeEW+et3OgpZAoFaonCc/ils
sE8VS6B8SMTW+/JhVE0s1VSG2jXXN4ENgoDFUIj3xbZYM7LNPYXk8+GxycGtBGiK
oKHcooyfgpSphElaKFKhvGlDNxDTf6JnTMDnUt7y5cdFcGVVxJgIXs8RCPC6mPjV
zVza/17RQOaYJicWW+I2hpNMgj9KOfMUmOfgNB/HeJTPtrsu8M6YpR6JppPJ4rhH
HyQW4JTJh3HG3RiVwagR
=3Xlf
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault