Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1283
tor security update
1 August 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tor
Publisher: Debian
Operating System: Debian GNU/Linux 7
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-5117
Original Bulletin:
http://www.debian.org/security/2014/dsa-2993
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running tor check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2993-1 security@debian.org
http://www.debian.org/security/ Peter Palfrader
July 31, 2014 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : tor
CVE ID : CVE-2014-5117
Several issues have been discovered in Tor, a connection-based
low-latency anonymous communication system, resulting in information
leaks.
o Relay-early cells could be used by colluding relays on the network to
tag user circuits and so deploy traffic confirmation attacks
[CVE-2014-5117]. The updated version emits a warning and drops the
circuit upon receiving inbound relay-early cells, preventing this
specific kind of attack. Please consult the following advisory for
more details about this issue:
https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack
o A bug in the bounds-checking in the 32-bit curve25519-donna
implementation could cause incorrect results on 32-bit
implementations when certain malformed inputs were used along with a
small class of private ntor keys. This flaw does not currently
appear to allow an attacker to learn private keys or impersonate a
Tor server, but it could provide a means to distinguish 32-bit Tor
implementations from 64-bit Tor implementations.
The following additional security-related improvements have been
implemented:
o As a client, the new version will effectively stop using CREATE_FAST
cells. While this adds computational load on the network, this
approach can improve security on connections where Tor's circuit
handshake is stronger than the available TLS connection security
levels.
o Prepare clients to use fewer entry guards by honoring the consensus
parameters. The following article provides some background:
https://blog.torproject.org/blog/improving-tors-anonymity-changing-guard-parameters
For the stable distribution (wheezy), these problems have been fixed in
version 0.2.4.23-1~deb7u1.
For the testing distribution (jessie) and the unstable distribution
(sid), these problems have been fixed in version 0.2.4.23-1.
For the experimental distribution, these problems have been fixed in
version 0.2.5.6-alpha-1.
We recommend that you upgrade your tor packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJT2ht+AAoJEAVMuPMTQ89EtFgP/3AWMfTTOxdZn046F/QemXPl
zuDTBhfllKc2s0UXOV63/yjfqr0oa703a/EhWIwZttc9NTi03NY9iKEwNeB+HUCN
b3hENNISFdVp5i11pmbExSTGhfmgBLMPXXJAKbj5Zz1wsUr4SKJpsI0caaBXOOYp
mTOHy0iKvT8RnpBiR0v2pXcCAQEqPy/7j99npO8SDwlOIcG7bmePc+L6YsHT99gh
shNxnnjQIqO45rVHkqVCJc7uEx5k3i3rq0nDQnTrbiZI4G2zOJi7XfteJlCzl0vc
XUt/7cTQeKyIRnNhRE09BctSs+bygCOJXY94iBoOc3eTxGeMoLcORRGZ8R1Jae99
cj8cfT3rH/SP1uWON071I9awwhXaC0nwHtkejAiA6S51rZBaUnQqCFEHp/D3ku7V
NZ8Iux1JYkuXFYyU/FgFouRpbyt3ApITgKFjCySZmH0Kcm7C78gUuHyXhgvQfhdw
MG9DvNIMlRKNAOXlBA9ZUSNpz1YzHRrv0KpwPnlaKSMwvuuuzhfXqFUzbEFLjbkL
pPx0goe/BAmdRDKD0to4JhnpzRh71HtZwIOwJWQpqQ/p2IN0s7C5hrfk+g+Bh5kl
fQBUnE18ZJC9ytQlUkYUd0Isc6HfmSQn3C2KA8pDV5jXn4tCMe9u2kfsB10uAPiY
K/PnpW3fw41iiJPdYDZI
=+/Vb
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU9roiRLndAQH1ShLAQJ6xg//VDWp8FWUREhlMFXB+CRBN7eQwkHmUKnl
8d+ollOCnofewJ3hznpI2KEMoa3LDtwDm6MyXOdsRynjEW0jNWofVI021BAg3vIh
MEZMfi69bHY24wyruPHIipAkLyGL1EVELApPGN4xBNgo8VBlETbzP12ETAcwNFPQ
y+9oGNj4lqrii+DrtWBvHi1vJp7xrjSNGXMhjvw+oO7GiMwVW6GeXjh4VdgC8gyv
KDzllzSRObDE3R/5EAxvCFqyZCGI2TI4EimQjFLWNN1m9LEd+Huj9VmNe8/mLRcW
txjicTCBh+0AoV/+jVPIg1lVyvZLL6STSTV/dNjfyEdqXFmyrxz1nc/Y+FNyIfyS
MM9AIiuCEZCeogJXPRIvSyYoOC0dFqiDjAdBLUeCRrD8F0dxsa2Lu839HnAh2r8N
uXnL7SsUt//dUsXowU6qQj9VLVQARYMweAPA4d7+lyb9vbGDQTGVMLv2qNZqGC+3
9a1xeo5YA8Pt6l/eDjjIErPjn5on1XopIJA5iKRe8DcACUfsRS1/BkodZAgZmJO9
W7E+KGH2W/pUHCGOE5c7VZOuVgcs1mkdaqvi/J3iE53HSqhA+w87HmWoR0IJm2f3
a72Xuzg6tNoc0MYAF/hgE/wVV8RrvRth3XstygdOmHCGvgskRZeVCHzrJArl2/im
3/Uy7b1BWlc=
=JDpp
-----END PGP SIGNATURE-----