Bug 20607
| Summary: | Tor DNS Spoofing and Denial of Service Vulnerabilities: CVE-2009-2425, CVE-2009-2426 | ||
|---|---|---|---|
| Product: | Sisyphus | Reporter: | Vladimir Lettiev <crux> |
| Component: | tor | Assignee: | Anton Farygin <rider> |
| Status: | CLOSED FIXED | QA Contact: | qa-sisyphus |
| Severity: | normal | ||
| Priority: | P3 | CC: | rider |
| Version: | unstable | Keywords: | security |
| Hardware: | all | ||
| OS: | Linux | ||
| URL: | http://archives.seul.org/or/announce/Jun-2009/msg00000.html | ||
Version in Sisyphus is updated to 0.2.0.35-alt2 |
Description
Vladimir Lettiev 2009-06-26 21:28:58 MSDChanges in version 0.2.0.35 - 2009-06-24 o Security fix: - Avoid crashing in the presence of certain malformed descriptors. Found by lark, and by automated fuzzing. - Fix an edge case where a malicious exit relay could convince a controller that the client's DNS question resolves to an internal IP address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta. ...