oss-sec mailing list archives
Re: tor DoS via SENDME cells
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 26 Nov 2012 11:43:43 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/26/2012 09:48 AM, Vincent Danen wrote:
I've not seen a CVE for this yet, could one get assigned? It was reported that Tor suffered from a denial of service vulnerability due to an error when handling SENDME cells. This could be exploited to cause excessive consumption of memory resources within an entry node. This is fixed in upstream version 0.2.3.25. References: https://secunia.com/advisories/51329/ https://trac.torproject.org/projects/tor/ticket/6252 https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16 https://bugzilla.redhat.com/show_bug.cgi?id=880310 https://bugs.gentoo.org/show_bug.cgi?id=444804 Thanks.
Please use Please use CVE-2012-5573 for this issue. for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQs7hfAAoJEBYNRVNeJnmTknAP/2Rv/H4SZe+YE1rB/zvPS+0C 3Jo6TSF95b94yKVuaqsktgB8kOUviSrzc0J9FvvzhB1RpheEhKZzBLDnlaS0GJ9+ hqWXnt4EyCEi6BNC1xyp88zrXeQdtJz5g6PTudaSHxTvIWPRINQjrZJEPSxk2EF1 PK0bHBKyjfdyKq9Yp3Gc84Q2XOqQ0TbbP5Eg9h+2twpm+2WakePm8kNmzF5iagPH rvzg6FFE8egaUyM0Hc13N0d15d19VZ3XTNV20YH4wdfocSWeVIgoq34g2GZ7clf4 WukVkjbeS/y/fo4Bsubml8b6FHfUOS03+8+L99f8uAgAF2cn1gRE6+A/SBDko0QN 10etjn2g3HO0CWfGRcgPL9mVFLRYNdQTJKQY570Hp+OZHmsu2zwPVJb6RlRxFWzE P7iCbu3ZUYUPDbIqsauTkn82efynttohJnBC7qksQeEW+et3OgpZAoFaonCc/ils sE8VS6B8SMTW+/JhVE0s1VSG2jXXN4ENgoDFUIj3xbZYM7LNPYXk8+GxycGtBGiK oKHcooyfgpSphElaKFKhvGlDNxDTf6JnTMDnUt7y5cdFcGVVxJgIXs8RCPC6mPjV zVza/17RQOaYJicWW+I2hpNMgj9KOfMUmOfgNB/HeJTPtrsu8M6YpR6JppPJ4rhH HyQW4JTJh3HG3RiVwagR =3Xlf -----END PGP SIGNATURE-----
Current thread:
- tor DoS via SENDME cells Vincent Danen (Nov 26)
- Re: tor DoS via SENDME cells Kurt Seifried (Nov 26)