Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.

Security fix for CVE-2014-5117

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tor 0.2.4.23 [bnc#889688] [CVE-2014-5117] Slows down the     risk from guard rotation and backports several important     fixes from the Tor 0.2.5 alpha release series.

  - Major features :

  - Clients now look at the 'usecreatefast' consensus     parameter to decide whether to use CREATE_FAST or CREATE     cells for the first hop of their circuit. This approach     can improve security on connections where Tor's circuit     handshake is stronger than the available TLS connection     security levels, but the tradeoff is more computational     load on guard relays.

  - Make the number of entry guards configurable via a new     NumEntryGuards consensus parameter, and the number of     directory guards configurable via a new     NumDirectoryGuards consensus parameter.

  - Major bugfixes :

  - Fix a bug in the bounds-checking in the 32-bit     curve25519-donna implementation that caused incorrect     results on 32-bit implementations when certain malformed     inputs were used along with a small class of private     ntor keys.

  - Minor bugfixes :

  - Warn and drop the circuit if we receive an inbound     'relay early' cell.

  - Correct a confusing error message when trying to extend     a circuit via the control protocol but we don't know a     descriptor or microdescriptor for one of the specified     relays.

  - Avoid an illegal read from stack when initializing the     TLS module using a version of OpenSSL without all of the     ciphers used by the v2 link handshake.

Updated tor package fixes security vulnerability :

Tor before 0.2.4.23 maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names (CVE-2014-5117).

Several issues have been discovered in Tor, a connection-based low-latency anonymous communication system, resulting in information leaks.

  - Relay-early cells could be used by colluding relays on     the network to tag user circuits and so deploy traffic     confirmation attacks [ CVE-2014-5117]. The updated     version emits a warning and drops the circuit upon     receiving inbound relay-early cells, preventing this     specific kind of attack. Please consult the following     advisory for more details about this issue :
    https://blog.torproject.org/blog/tor-security-advisory-r     elay-early-traffic-confirmation-attack

  - A bug in the bounds-checking in the 32-bit     curve25519-donna implementation could cause incorrect     results on 32-bit implementations when certain malformed     inputs were used along with a small class of private     ntor keys. This flaw does not currently appear to allow     an attacker to learn private keys or impersonate a Tor     server, but it could provide a means to distinguish     32-bit Tor implementations from 64-bit Tor     implementations.
The following additional security-related improvements have been implemented :

  - As a client, the new version will effectively stop using     CREATE_FAST cells. While this adds computational load on     the network, this approach can improve security on     connections where Tor's circuit handshake is stronger     than the available TLS connection security levels.
  - Prepare clients to use fewer entry guards by honoring     the consensus parameters. The following article provides     some background :

    https://blog.torproject.org/blog/improving-tors-anonymit     y-changing-guard-parameters

The Tor Project reports :

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.

ID	Name	Product	Family	Severity
77209	Fedora 20 : tor-0.2.4.23-1.fc20 (2014-9082)	Nessus	Fedora Local Security Checks	medium
77208	Fedora 19 : tor-0.2.4.23-1.fc19 (2014-9073)	Nessus	Fedora Local Security Checks	medium
77136	openSUSE Security Update : tor (openSUSE-SU-2014:0975-1)	Nessus	SuSE Local Security Checks	medium
77038	Mandriva Linux Security Advisory : tor (MDVSA-2014:150)	Nessus	Mandriva Local Security Checks	medium
76949	Debian DSA-2993-1 : tor - security update	Nessus	Debian Local Security Checks	medium
76922	FreeBSD : tor -- traffic confirmation attack (31c09848-1829-11e4-bf04-60a44c524f57)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-5117

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium