SB2017061218 - Reachable Assertion in tor (Alpine package)
Published: June 12, 2017
Security Bulletin ID
SB2017061218
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Reachable Assertion (CVE-ID: CVE-2017-0376)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=d17a014c3419283d71293e0cd45a8c7178393632
- https://git.alpinelinux.org/aports/commit/?id=2185d3b8d25a0f2e63d09e74b9c29683ef41bc2d
- https://git.alpinelinux.org/aports/commit/?id=fa90dd6af64db342b7d78e20257af1a6782892a5
- https://git.alpinelinux.org/aports/commit/?id=77254b9849fec40862d6d67e97dcdbb5f7208ade
- https://git.alpinelinux.org/aports/commit/?id=53f4e4e2a7a04028c529a6ac04f59cd54ee834c4
- https://git.alpinelinux.org/aports/commit/?id=e9d50cc6a8aa0e01b165e72e71da208450ade693
- https://git.alpinelinux.org/aports/commit/?id=6af559cf08cf1b597fe4898fdf1b53b52777c1ac
- https://git.alpinelinux.org/aports/commit/?id=3e26e24ea829df4108d748f5ccd6fd3f0cca9c85