[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <50B3B85F.70806@redhat.com>
Date: Mon, 26 Nov 2012 11:43:43 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Vincent Danen <vdanen@...hat.com>
Subject: Re: tor DoS via SENDME cells
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/26/2012 09:48 AM, Vincent Danen wrote:
> I've not seen a CVE for this yet, could one get assigned?
>
> It was reported that Tor suffered from a denial of service
> vulnerability due to an error when handling SENDME cells. This
> could be exploited to cause excessive consumption of memory
> resources within an entry node.
>
> This is fixed in upstream version 0.2.3.25.
>
> References:
>
> https://secunia.com/advisories/51329/
> https://trac.torproject.org/projects/tor/ticket/6252
> https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16
>
> https://bugzilla.redhat.com/show_bug.cgi?id=880310
> https://bugs.gentoo.org/show_bug.cgi?id=444804
>
> Thanks.
Please use Please use CVE-2012-5573 for this issue. for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQs7hfAAoJEBYNRVNeJnmTknAP/2Rv/H4SZe+YE1rB/zvPS+0C
3Jo6TSF95b94yKVuaqsktgB8kOUviSrzc0J9FvvzhB1RpheEhKZzBLDnlaS0GJ9+
hqWXnt4EyCEi6BNC1xyp88zrXeQdtJz5g6PTudaSHxTvIWPRINQjrZJEPSxk2EF1
PK0bHBKyjfdyKq9Yp3Gc84Q2XOqQ0TbbP5Eg9h+2twpm+2WakePm8kNmzF5iagPH
rvzg6FFE8egaUyM0Hc13N0d15d19VZ3XTNV20YH4wdfocSWeVIgoq34g2GZ7clf4
WukVkjbeS/y/fo4Bsubml8b6FHfUOS03+8+L99f8uAgAF2cn1gRE6+A/SBDko0QN
10etjn2g3HO0CWfGRcgPL9mVFLRYNdQTJKQY570Hp+OZHmsu2zwPVJb6RlRxFWzE
P7iCbu3ZUYUPDbIqsauTkn82efynttohJnBC7qksQeEW+et3OgpZAoFaonCc/ils
sE8VS6B8SMTW+/JhVE0s1VSG2jXXN4ENgoDFUIj3xbZYM7LNPYXk8+GxycGtBGiK
oKHcooyfgpSphElaKFKhvGlDNxDTf6JnTMDnUt7y5cdFcGVVxJgIXs8RCPC6mPjV
zVza/17RQOaYJicWW+I2hpNMgj9KOfMUmOfgNB/HeJTPtrsu8M6YpR6JppPJ4rhH
HyQW4JTJh3HG3RiVwagR
=3Xlf
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
