Information disclosure in Tor - CVE-2017-0380
Published: October 9, 2017 / Updated: October 17, 2017
Vulnerability identifier: #VU8851
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-0380
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists in the rend_service_intro_established() function in 'or/rendservice.c due to the system may log uninitialized stack contents when a certain hidden service error occurs while SafeLogging is disabled. A remote attacker can use an error message about the construction of an introduction point circuit and gain access to potentially sensitive information from uninitialized stack memory.
Affected software
Tor
Debian Linux
Fedora
tor (Alpine package)
tor
Debian Linux
Fedora
tor (Alpine package)
tor
How to mitigate CVE-2017-0380
The vulnerability is addressed in the following versions: 0.2.8.15, 0.2.9.12, 0.3.0.11.
tor (Alpine package) - update to 0.3.0.8-r1
tor - addressed in versions 0.2.9.12-1.el6, 0.2.9.12-1.el7, 0.2.9.12-1.fc25, 0.2.9.12-1.fc26, 0.2.9.12-1.fc27, 0.3.1.7-1.fc26, 0.3.1.7-1.fc27
tor - addressed in versions 0.2.9.12-1.el6, 0.2.9.12-1.el7, 0.2.9.12-1.fc25, 0.2.9.12-1.fc26, 0.2.9.12-1.fc27, 0.3.1.7-1.fc26, 0.3.1.7-1.fc27