Detections
Analytics
Mandriva Linux Security Advisory : tor (MDVSA-2015:205)
medium Nessus Plugin ID 83097
Language:
Synopsis
The remote Mandriva Linux host is missing a security update.Description
Updated tor packages fix security vulnerabilities :disgleirio discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible (CVE-2015-2928).
DonnchaC discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidden service descriptors (CVE-2015-2929).
Introduction points would accept multiple INTRODUCE1 cells on one circuit, making it inexpensive for an attacker to overload a hidden service with introductions. Introduction points now no longer allow multiple cells of that type on the same circuit.
The tor package has been updated to version 0.2.4.27, fixing these issues.
Solution
Update the affected tor package.See Also
Plugin Details
Severity: Medium
ID: 83097
File Name: mandriva_MDVSA-2015-205.nasl
Version: 2.4
Type: local
Family: Mandriva Local Security Checks
Published: 4/28/2015
Updated: 1/14/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:tor, cpe:/o:mandriva:business_server:1
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 4/27/2015
Reference Information
CVE: CVE-2015-2928, CVE-2015-2929
MDVSA: 2015:205