The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.

update to upstream release 0.3.1.7

----

update to upstream release 0.2.9.12 (SECURITY) (#1494860)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to upstream release 0.2.9.12 (SECURITY) (#1494860)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Tor onion service could leak sensitive information to log files if the 'SafeLogging' option is set to '0'.

The oldstable distribution (jessie) is not affected.

This update for tor fixes the following issues :

  - CVE-2017-0380: hidden services with the SafeLogging     option disabled could disclose the stack (boo#1059194)

ID	Name	Product	Family	Severity
105958	Fedora 27 : tor (2017-b2c714515b)	Nessus	Fedora Local Security Checks	high
103887	Fedora 25 : tor (2017-238961d86d)	Nessus	Fedora Local Security Checks	medium
103883	Fedora 26 : tor (2017-1179268a20)	Nessus	Fedora Local Security Checks	medium
103716	Debian DSA-3993-1 : tor - security update	Nessus	Debian Local Security Checks	medium
103487	openSUSE Security Update : tor (openSUSE-2017-1092)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2017-0380

medium

Tenable Plugins

high

medium

medium

medium

medium