[ GLSA 200508-16 ] Tor: Information disclosure

[GLSA]

Gentoo Linux Security Advisory

Title: Tor: Information disclosure (GLSA 200508-16)
Severity: low
Exploitable: remote
Date: August 25, 2005
Bug(s): #102245
ID: 200508-16

Synopsis


A flaw in Tor leads to the disclosure of information and the loss of
anonymity, integrity and confidentiality.


Background


Tor is an implementation of second generation Onion Routing, a
connection-oriented anonymizing communication service.


Affected Packages

Package: net-misc/tor
Vulnerable: < 0.1.0.14
Unaffected: >= 0.1.0.14
Architectures: All supported architectures


Description


The Diffie-Hellman implementation of Tor fails to verify the
cryptographic strength of keys which are used during handshakes.


Impact


By setting up a malicious Tor server and enticing users to use
this server as first hop, a remote attacker could read and modify all
traffic of the user.


Workaround


There is no known workaround at this time.


Resolution


All Tor users should upgrade to the latest version: