CVE-2017-8820

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service (NULL pointer dereference and application crash) against directory authorities via a malformed descriptor, aka TROVE-2017-010.

When checking for replays in the INTRODUCE1 cell data for a (legacy) onion service, Tor didn't correctly detect replays in the RSA- encrypted part of the cell. It was previously checking for replays on the entire cell, but those can be circumvented due to the malleability of Tor's legacy hybrid encryption. This can lead to a traffic confirmation attack (CVE-2017-8819).

Denial of service issue where an attacker could crash a directory authority using a malformed router descriptor (CVE-2017-8820).

Denial of service bug where an attacker could use a malformed directory object to cause a Tor instance to pause while OpenSSL would try to read a passphrase from the terminal (CVE-2017-8821).

When running as a relay, Tor could build a path through itself, especially when it lost the version of its descriptor appearing in the consensus. When running as a relay, it could also choose itself as a guard (CVE-2017-8822).

Use-after-free error that could crash v2 Tor onion services when they failed to open circuits while expiring introduction points (CVE-2017-8823).

This update for tor fixes vulnerabilities that allowed some traffic confirmation, DoS and other attacks (bsc#1070849):

• CVE-2017-8819: Replay-cache ineffective for v2 onion services
• CVE-2017-8820: Remote DoS attack against directory authorities
• CVE-2017-8821: An attacker can make Tor ask for a password
• CVE-2017-8822: Relays can pick themselves in a circuit path
• CVE-2017-8823: Use-after-free in onion service v2

This update for tor fixes vulnerabilities that allowed some traffic confirmation, DoS and other attacks (bsc#1070849):

• CVE-2017-8819: Replay-cache ineffective for v2 onion services
• CVE-2017-8820: Remote DoS attack against directory authorities
• CVE-2017-8821: An attacker can make Tor ask for a password
• CVE-2017-8822: Relays can pick themselves in a circuit path
• CVE-2017-8823: Use-after-free in onion service v2

These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.