The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

This update to tor 0.2.9.11 fixes the following vulnerabilities :

  - CVE-2017-0375: remotely triggerable assertion failure     when a hidden service handles a malformed BEGIN cell     (bsc#1043455)

  - CVE-2017-0376: remotely triggerable assertion failure     caused by receiving a BEGIN_DIR cell on a hidden service     rendezvous circuit (bsc#1043456)

It has been discovered that Tor, a connection-based low-latency anonymous communication system, contain a flaw in the hidden service code when receiving a BEGIN_DIR cell on a hidden service rendezvous circuit. A remote attacker can take advantage of this flaw to cause a hidden service to crash with an assertion failure (TROVE-2017-005).

It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a flaw in the hidden service code. A remote attacker can take advantage of this flaw to cause a hidden service to crash with an assertion failure (TROVE-2017-005).

For Debian 7 'Wheezy', this problem has been fixed in version 0.2.4.29-1.

We recommend that you upgrade your tor packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
100831	openSUSE Security Update : tor (openSUSE-2017-690)	Nessus	SuSE Local Security Checks	high
100728	Debian DSA-3877-1 : tor - security update	Nessus	Debian Local Security Checks	high
100724	Debian DLA-982-1 : tor security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-0376

high

Tenable Plugins

high

high

high