3413 matches found
Tor security advisory: cross-protocol http form attack
http://archives.seul.org/or/announce/Sep-2007/msg00000.html "... a malicious website or Tor exit node can give the Tor user a page that includes a POST element directed to Tor's control port localhost:9051... This particular attack worked because Tor's control protocol gave an error message on...
Tor cross application scripting
Cross applicaiton scripting via Tor proxy erro message...
[SECURITY] Fedora 7 Update: tor-0.1.2.16-1.fc7
Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...
Tor ControlPort功能torrc配置文件重写漏洞
BUGTRAQ ID: 25188 Tor是一个工具集，帮助各类组织和个人增强互联网上活动的安全。 Tor在处理特定的连接功能时存在漏洞，远程攻击者可能利用此漏洞非授权获取访问。 如果启用了Tor中的ControlPort功能的话，则在处理到ControlPort的多个连接时远程攻击者可以在某些情况下非授权重写用户的torrc配置文件，这可能弱化软件所提供的匿名服务。 Tor 0.1.2.15 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://tor.eff.org/download.html.en...
CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
Authentication flaw
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
DEBIAN-CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
CVE-2007-4174
CVE-2007-4174 affects Tor prior to 0.1.2.16, where enabling ControlPort allows remote commands to be sent via HTTP POST without authentication to localhost port 9051, enabling modification of torrc and potential anonymity compromise. Public feeds confirm the issue and reference Fedora advisories ...
CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
CVE-2007-4174: Undefined Security Weakness
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
Tor 0.1.2.15 - ControlPort Missing Authentication Unauthorized Access
Tor 0.1.2.15 - ControlPort Missing Authentication Unauthorized Access source: https://www.securityfocus.com/bid/25188/info Tor is prone to an unauthorized-access vulnerability due to a design error when handling multiple connections to the ControlPort. An attacker can exploit this issue to...
Tor 0.1.2.15 - ControlPort Missing Authentication Unauthorized Access
source: https://www.securityfocus.com/bid/25188/info Tor is prone to an unauthorized-access vulnerability due to a design error when handling multiple connections to the ControlPort. An attacker can exploit this issue to reconfigure Tor and significantly weaken the anonymity provided by the...
CVE-2007-4098
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams...
CVE-2007-4099
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks...
CVE-2007-4098
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams...
Design/Logic Flaw
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks...