Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-201101-02 (Tor: Remote heap-based buffer overflow)

    Tor contains a heap-based buffer overflow in the processing of user or     attacker supplied data. No additional information is available.
  Impact :

    Successful exploitation of this vulnerability may allow an     unauthenticated remote attacker to execute arbitrary code with the     permissions of the Tor user, or to cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Willem Pinckaers discovered that Tor, a tool to enable online anonymity, does not correctly handle all data read from the network.
By supplying specially crafted packets a remote attacker can cause Tor to overflow its heap, crashing the process. Arbitrary code execution has not been confirmed but there is a potential risk.

In the stable distribution (lenny), this update also includes an update of the IP address for the Tor directory authority gabelmoo and addresses a weakness in the package's postinst maintainer script.

Major bugfixes :

  - Fix a remotely exploitable bug that could be used to     crash instances of Tor remotely by overflowing on the     heap. Remote-code execution hasn't been confirmed, but     can't be ruled out. Everyone should upgrade.
    (CVE-2010-1676)

Directory authority changes :

  - Change IP address and ports for gabelmoo (v3 directory     authority).

Minor features :

  - Update to the December 1 2010 Maxmind GeoLite Country     database.

https://blog.torproject.org/blog/tor-02128-released-security-patches

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Tor Project reports :

Remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade.

ID	Name	Product	Family	Severity
51532	GLSA-201101-02 : Tor: Remote heap-based buffer overflow	Nessus	Gentoo Local Security Checks	critical
51398	Debian DSA-2136-1 : tor - buffer overflow	Nessus	Debian Local Security Checks	critical
51392	Fedora 13 : tor-0.2.1.28-1300.fc13 (2010-19159)	Nessus	Fedora Local Security Checks	critical
51391	Fedora 14 : tor-0.2.1.28-1400.fc14 (2010-19147)	Nessus	Fedora Local Security Checks	critical
51363	FreeBSD : tor -- remote crash and potential remote code execution (4bd33bc5-0cd6-11e0-bfa4-001676740879)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2010-1676

critical

Tenable Plugins

critical

critical

critical

critical

critical