Bug 880310 (CVE-2012-5573)

Summary:	CVE-2012-5573 tor: denial of service when handling SENDME cells
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lmacken, rh-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-03 18:19:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	880313, 880314
Bug Blocks:

Description Vincent Danen 2012-11-26 16:41:03 UTC

It was reported [1],[2] that Tor suffered from a denial of service vulnerability due to an error when handling SENDME cells.  This could be exploited to cause excessive consumption of memory resources within an entry node.

This is fixed in upstream version 0.2.3.25 (git [3]).

[1] https://secunia.com/advisories/51329/
[2] https://trac.torproject.org/projects/tor/ticket/6252
[3] https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16

Comment 1 Vincent Danen 2012-11-26 16:46:15 UTC

Created tor tracking bugs for this issue

Affects: fedora-all [bug 880313]
Affects: epel-5 [bug 880314]

Comment 2 Vincent Danen 2012-11-26 19:24:42 UTC

This was assigned CVE-2012-5573:

http://www.openwall.com/lists/oss-security/2012/11/26/11

Comment 3 Fedora Update System 2013-03-16 01:39:37 UTC

tor-0.2.3.25-1802.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-03-24 22:52:05 UTC

tor-0.2.3.25-1702.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.