Tor: Information disclosure

Background

Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service.

Description

The Diffie-Hellman implementation of Tor fails to verify the cryptographic strength of keys which are used during handshakes.

Impact

By setting up a malicious Tor server and enticing users to use this server as first hop, a remote attacker could read and modify all traffic of the user.

Workaround

There is no known workaround at this time.

Resolution

All Tor users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/tor-0.1.0.14"