The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419.

- update to 0.2.2.39 [bnc#780620] Changes in version     0.2.2.39 - 2012-09-11 Tor 0.2.2.39 fixes two more     opportunities for remotely triggerable assertions. o     Security fixes :

  - Fix an assertion failure in tor_timegm() that could be     triggered by a badly formatted directory object     (CVE-2012-4922).

  - Do not crash when comparing an address with port value 0     to an address policy. This bug could have been used to     cause a remote assertion failure by or against directory     authorities, or to allow some applications to crash     clients (CVE-2012-4419).

. .

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201301-03 (Tor: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tor. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

. . .

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74768	openSUSE Security Update : tor (openSUSE-SU-2012:1278-1)	Nessus	SuSE Local Security Checks	medium
64440	Fedora 17 : tor-0.2.2.39-1700.fc17 (2012-14650)	Nessus	Fedora Local Security Checks	medium
63437	GLSA-201301-03 : Tor: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
62234	Fedora 18 : tor-0.2.2.39-1800.fc18 (2012-14638)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-4922

high

Tenable Plugins

medium

medium

medium

medium