oss-security - Re: CVE id request: Tor <0.2.0.34 multiple DoS

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 17 Mar 2009 20:37:50 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: Tor <0.2.0.34 multiple DoS


======================================================
Name: CVE-2009-0936
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0936
Reference: MLIST:[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)
Reference: URL:http://archives.seul.org/or/announce/Feb-2009/msg00000.html
Reference: SECUNIA:33880
Reference: URL:http://secunia.com/advisories/33880

Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to
cause a denial of service (infinite loop) via "corrupt votes."


======================================================
Name: CVE-2009-0937
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0937
Reference: MLIST:[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)
Reference: URL:http://archives.seul.org/or/announce/Feb-2009/msg00000.html
Reference: SECUNIA:33880
Reference: URL:http://secunia.com/advisories/33880

Unspecified vulnerability in Tor before 0.2.0.34 allows directory
mirrors to cause a denial of service via unknown vectors.


======================================================
Name: CVE-2009-0938
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0938
Reference: MLIST:[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)
Reference: URL:http://archives.seul.org/or/announce/Feb-2009/msg00000.html
Reference: SECUNIA:33880
Reference: URL:http://secunia.com/advisories/33880

Unspecified vulnerability in Tor before 0.2.0.34 allows directory
mirrors to cause a denial of service (exit node crash) via "malformed
input."


======================================================
Name: CVE-2009-0939
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0939
Reference: MLIST:[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)
Reference: URL:http://archives.seul.org/or/announce/Feb-2009/msg00000.html
Reference: SECUNIA:33880
Reference: URL:http://secunia.com/advisories/33880

Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which
has unknown impact and attack vectors related to "Spec conformance,"
as demonstrated using 192.168.0.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.