[ASA-201712-10] tor: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201712-10
==========================================

Severity: High
Date    : 2017-12-16
CVE-ID  : CVE-2017-8819 CVE-2017-8820 CVE-2017-8822 CVE-2017-8823
Package : tor
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-539

Summary
=======

The package tor before version 0.3.1.9-1 is vulnerable to multiple
issues including arbitrary code execution, information disclosure and
denial of service.

Resolution
==========

Upgrade to 0.3.1.9-1.

# pacman -Syu "tor>=0.3.1.9-1"

The problems have been fixed upstream in version 0.3.1.9.

Workaround
==========

None.

Description
===========

- CVE-2017-8819 (information disclosure)

An issue has been found in the way Tor before 0.3.1.9 checked for
replays, leading to a possible traffic confirmation attack.

- CVE-2017-8820 (denial of service)

A denial of service issue where an attacker could crash a directory
authority using a malformed router descriptor has been found in Tor
before 0.3.1.9.

- CVE-2017-8822 (information disclosure)

In Tor before 0.3.1.9, relays (that have incompletely downloaded
descriptors) can pick themselves in a circuit path, leading to a
degradation of anonymity, aka TROVE-2017-012.

- CVE-2017-8823 (arbitrary code execution)

A use-after-free vulnerability has been found in Tor before 0.3.1.9,
leading to a crash of v2 Tor onion services when they failed to open
circuits while expiring introduction points.

Impact
======

A remote attacker might be able to reduce the anonymity of Tor users,
cause a denial of service or execute arbitrary code on the affected
host.

References
==========

https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516
https://trac.torproject.org/projects/tor/ticket/24244
https://trac.torproject.org/projects/tor/ticket/24245
https://bugs.torproject.org/21534
https://bugs.torproject.org/24333
https://trac.torproject.org/projects/tor/ticket/24313
https://security.archlinux.org/CVE-2017-8819
https://security.archlinux.org/CVE-2017-8820
https://security.archlinux.org/CVE-2017-8822
https://security.archlinux.org/CVE-2017-8823

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171216/6dee2c49/attachment.asc>