ID CVE-2006-0414 Type cve Reporter cve@mitre.org Modified 2017-07-20T01:29:00
Description
Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server.
{"gentoo": [{"lastseen": "2016-09-06T19:46:42", "bulletinFamily": "unix", "description": "### Background\n\nTor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. \n\n### Description\n\nSome integer overflows exist when adding elements to the smartlists. Non-printable characters received from the network are not properly sanitised before being logged. There are additional unspecified bugs in the directory server and in the internal circuits. \n\n### Impact\n\nThe possible buffer overflow may allow a remote attacker to execute arbitrary code on the server by sending large inputs. The other vulnerabilities can lead to a Denial of Service, a lack of logged information, or some information disclosure. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll Tor users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose net-misc/tor", "modified": "2006-09-05T00:00:00", "published": "2006-06-07T00:00:00", "id": "GLSA-200606-04", "href": "https://security.gentoo.org/glsa/200606-04", "type": "gentoo", "title": "Tor: Several vulnerabilities", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "freebsd": [{"lastseen": "2019-05-29T18:34:48", "bulletinFamily": "unix", "description": "\nRoger Dingledine reports:\n\nIf you offer a Tor hidden service, an adversary who can\n\t run a fast Tor server and who knows some basic statistics\n\t can find the location of your hidden service in a matter of\n\t minutes to hours.\n\n", "modified": "2006-01-12T00:00:00", "published": "2006-01-12T00:00:00", "id": "D38E1810-9EF7-11DA-B410-000E0C2E438A", "href": "https://vuxml.freebsd.org/freebsd/d38e1810-9ef7-11da-b410-000e0c2e438a.html", "title": "tor -- malicious tor server can locate a hidden service", "type": "freebsd", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:19", "bulletinFamily": "software", "description": "## Solution Description\nUpgrade to version 0.1.1.12-alpha or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\nVendor URL: http://tor.eff.org/\n[Vendor Specific Advisory URL](http://www.gentoo.org/security/en/glsa/glsa-200606-04.xml)\n[Secunia Advisory ID:20514](https://secuniaresearch.flexerasoftware.com/advisories/20514/)\n[Secunia Advisory ID:18576](https://secuniaresearch.flexerasoftware.com/advisories/18576/)\n[Secunia Advisory ID:20277](https://secuniaresearch.flexerasoftware.com/advisories/20277/)\nOther Advisory URL: http://archives.seul.org/or/announce/Jan-2006/msg00001.html\n[CVE-2006-0414](https://vulners.com/cve/CVE-2006-0414)\nBugtraq ID: 18323\n", "modified": "2006-01-12T04:33:31", "published": "2006-01-12T04:33:31", "href": "https://vulners.com/osvdb/OSVDB:22689", "id": "OSVDB:22689", "type": "osvdb", "title": "EFF Tor Hidden Service Disclosure", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "openvas": [{"lastseen": "2017-07-02T21:10:14", "bulletinFamily": "scanner", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-10-04T00:00:00", "published": "2008-09-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=56263", "id": "OPENVAS:56263", "title": "FreeBSD Ports: tor", "type": "openvas", "sourceData": "#\n#VID d38e1810-9ef7-11da-b410-000e0c2e438a\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: tor\n\nCVE-2006-0414\nTor 0.1.1.10-alpha and earlier allows remote attackers to identify\nhidden services via a malicious Tor server that attempts a large\nnumber of accesses of the hidden service, which eventually causes a\ncircuit to be built through the malicious server.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://archives.seul.org/or/announce/Jan-2006/msg00001.html\nhttp://www.vuxml.org/freebsd/d38e1810-9ef7-11da-b410-000e0c2e438a.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(56263);\n script_version(\"$Revision: 4203 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-10-04 07:30:30 +0200 (Tue, 04 Oct 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2006-0414\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"FreeBSD Ports: tor\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"tor\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.1.0.12\")<0) {\n txt += 'Package tor version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-07-24T12:50:17", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200606-04.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=56927", "id": "OPENVAS:56927", "title": "Gentoo Security Advisory GLSA 200606-04 (tor)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Tor is vulnerable to a possible buffer overflow, a Denial of Service,\ninformation disclosure and information leak.\";\ntag_solution = \"All Tor users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/tor-0.1.1.20'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200606-04\nhttp://bugs.gentoo.org/show_bug.cgi?id=134329\nhttp://tor.eff.org/cvs/tor/ChangeLog\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200606-04.\";\n\n \n\nif(description)\n{\n script_id(56927);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_cve_id(\"CVE-2006-0414\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Gentoo Security Advisory GLSA 200606-04 (tor)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"net-misc/tor\", unaffected: make_list(\"ge 0.1.1.20\"), vulnerable: make_list(\"lt 0.1.1.20\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "nessus": [{"lastseen": "2019-12-13T07:32:25", "bulletinFamily": "scanner", "description": "Roger Dingledine reports :\n\nIf you offer a Tor hidden service, an adversary who can run a fast Tor\nserver and who knows some basic statistics can find the location of\nyour hidden service in a matter of minutes to hours.", "modified": "2019-12-02T00:00:00", "id": "FREEBSD_PKG_D38E18109EF711DAB410000E0C2E438A.NASL", "href": "https://www.tenable.com/plugins/nessus/21515", "published": "2006-05-13T00:00:00", "title": "FreeBSD : tor -- malicious tor server can locate a hidden service (d38e1810-9ef7-11da-b410-000e0c2e438a)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(21515);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2019/08/02 13:32:38\");\n\n script_cve_id(\"CVE-2006-0414\");\n\n script_name(english:\"FreeBSD : tor -- malicious tor server can locate a hidden service (d38e1810-9ef7-11da-b410-000e0c2e438a)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Roger Dingledine reports :\n\nIf you offer a Tor hidden service, an adversary who can run a fast Tor\nserver and who knows some basic statistics can find the location of\nyour hidden service in a matter of minutes to hours.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://archives.seul.org/or/announce/Jan-2006/msg00001.html\"\n );\n # https://vuxml.freebsd.org/freebsd/d38e1810-9ef7-11da-b410-000e0c2e438a.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c48aa292\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:tor\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/01/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/05/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"tor<0.1.0.12\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-12-13T07:33:18", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200606-04\n(Tor: Several vulnerabilities)\n\n Some integer overflows exist when adding elements to the smartlists.\n Non-printable characters received from the network are not properly\n sanitised before being logged. There are additional unspecified bugs in\n the directory server and in the internal circuits.\n \nImpact :\n\n The possible buffer overflow may allow a remote attacker to execute\n arbitrary code on the server by sending large inputs. The other\n vulnerabilities can lead to a Denial of Service, a lack of logged\n information, or some information disclosure.\n \nWorkaround :\n\n There is no known workaround at this time.", "modified": "2019-12-02T00:00:00", "id": "GENTOO_GLSA-200606-04.NASL", "href": "https://www.tenable.com/plugins/nessus/21671", "published": "2006-06-08T00:00:00", "title": "GLSA-200606-04 : Tor: Several vulnerabilities", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200606-04.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(21671);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2019/08/02 13:32:43\");\n\n script_cve_id(\"CVE-2006-0414\");\n script_xref(name:\"GLSA\", value:\"200606-04\");\n\n script_name(english:\"GLSA-200606-04 : Tor: Several vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200606-04\n(Tor: Several vulnerabilities)\n\n Some integer overflows exist when adding elements to the smartlists.\n Non-printable characters received from the network are not properly\n sanitised before being logged. There are additional unspecified bugs in\n the directory server and in the internal circuits.\n \nImpact :\n\n The possible buffer overflow may allow a remote attacker to execute\n arbitrary code on the server by sending large inputs. The other\n vulnerabilities can lead to a Denial of Service, a lack of logged\n information, or some information disclosure.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n # http://tor.eff.org/cvs/tor/ChangeLog\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://tor.eff.org//cvs/tor/ChangeLog\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200606-04\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Tor users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose net-misc/tor\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:tor\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/06/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/06/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-misc/tor\", unaffected:make_list(\"ge 0.1.1.20\", \"rge 0.1.0.18\"), vulnerable:make_list(\"lt 0.1.1.20\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Tor\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}]}
