Default configuration

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

CVE-2008-5398

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

CVE-2008-5398

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

DEBIAN-CVE-2008-5398

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

DEBIAN-CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

Code injection

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

CVE-2008-5398

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

Tor绕过安全限制和权限提升漏洞

BUGTRAQ ID: 32648 Tor（The Onion Router）是第二代洋葱路由的一种实现，用户通过Tor可以在因特网上进行匿名交流。 Tor没有正确地丢弃通过User参数所指定的用户主组权限，这可能导致以非预期权限运行tor进程。这个漏洞仅影响UNIX类操作系统。 Tor没有正确地强制ClientDNSRejectInternalAddresses配置选项，这可能会削弱安全性，允许攻击者较容易的绕过安全限制。 Tor 0.2.0.31 Tor --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-5397

Tor before 0.2.0.32 is affected by CVE-2008-5397: the application does not properly handle the User and Group configuration options, which can allow local users to escalate privileges through unintended supplementary group memberships of the Tor process. Affected component: Tor daemon; root cause...

CVE-2008-5398

CVE-2008-5398 affects Tor up to version before 0.2.0.32, where the ClientDNSRejectInternalAddresses option is not consistently enforced when an exit relay issues a policy-based stream refusal. This can allow remote exit relays to map an internal IP address to the destination hostname of the refus...

CVE-2008-5398

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

CVE-2008-5398

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

[Backports-security-announce] Security Update for tor

Peter Palfrader uploaded new packages for tor which fixed the following security problem: Debian Bug 505178 tor didnt properly drop privileges when using the "User" and "Group" config options. For the etch-backports distribution the problem has been fixed in version 0.2.0.32-1bpo40+1. For the len...

[Backports-security-announce] Security Update for tor

Peter Palfrader uploaded new packages for tor which fixed the following security problem: Debian Bug 505178 tor didnt properly drop privileges when using the "User" and "Group" config options. For the etch-backports distribution the problem has been fixed in version 0.2.0.32-1bpo40+1. For the len...

Gentoo Security Advisory GLSA 200506-18 (tor)

The remote host is missing updates announced in advisory GLSA 200506-18. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...